Executive brief
A vulnerability in the Linux kernel's BPF subsystem could allow a local attacker to cause a system crash or potentially gain unauthorized access to sensitive information. The issue occurs when certain types of specialized network programs (BPF) are chained together in a way that bypasses security checks, leading to a memory error. This affects systems running Linux kernel versions 4.17 and newer.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel BPF subsystem due to insufficient validation of 'expected_attach_type' during tailcall operations. When a BPF program (progA) performs a tailcall into another program (progB) with a different expected_attach_type, it can bypass access validations (such as those in xdp_is_valid_access). This allows progB to access context members like 'txq' or 'egress_ifindex' that are uninitialized or restricted in the caller's context. The fix enforces 'expected_attach_type' compatibility in the '__bpf_prog_map_compatible' function for tailcall maps. Patches are available in various stable kernel branches including 6.1.x, 6.6.x, and 6.12.x.
Affected products
- Linux Linux 4.17 to 6.1.156, 6.6.112, 6.12.53, 6.17.3
Timeline
- 2025-11-12: advisory: CVE-2025-40123 published by NVD
- 2025-09-26: patched: Initial fix authored by Daniel Borkmann
References
- https://git.kernel.org/stable/c/08cb3dc9d2b44f153d0bcf2cb966e4a94b5d0f32
- https://git.kernel.org/stable/c/4540aed51b12bc13364149bf95f6ecef013197c0
- https://git.kernel.org/stable/c/a99de19128aec0913f3d529f529fbbff5edfaff8
- https://git.kernel.org/stable/c/c1ad19b5d8e23123503dcaf2d4342e1b90b923ad
- https://git.kernel.org/stable/c/f856c598080ba7ce1252867b8ecd6ad5bdaf9a6a