-

CVE-2025-40169

bpf: Reject negative offsets for ALU ops

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject negative offsets for ALU ops

When verifying BPF programs, the check_alu_op() function validates
instructions with ALU operations. The 'offset' field in these
instructions is a signed 16-bit integer.

The existing check 'insn->off > 1' was intended to ensure the offset is
either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is
signed, this check incorrectly accepts all negative values (e.g., -1).

This commit tightens the validation by changing the condition to
'(insn->off != 0 && insn->off != 1)'. This ensures that any value
other than the explicitly permitted 0 and 1 is rejected, hardening the
verifier against malformed BPF programs.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version ec0e2da95f72d4a46050a4d994e4fe471474fd80
Version < 3bce44b344040e5eef3d64d38b157c15304c0aab
Status affected
Version ec0e2da95f72d4a46050a4d994e4fe471474fd80
Version < 5017c302ca4b2a45149ad64e058fa2d5623c068f
Status affected
Version ec0e2da95f72d4a46050a4d994e4fe471474fd80
Version < 21167bf70dbe400563e189ac632258d35eda38b5
Status affected
Version ec0e2da95f72d4a46050a4d994e4fe471474fd80
Version < 55c0ced59fe17dee34e9dfd5f7be63cbab207758
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.6
Status affected
Version 0
Version < 6.6
Status unaffected
Version <= 6.6.*
Version 6.6.112
Status unaffected
Version <= 6.12.*
Version 6.12.53
Status unaffected
Version <= 6.17.*
Version 6.17.3
Status unaffected
Version <= *
Version 6.18
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.078
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.