CVE-2025-40169
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs.
How to fix
- Linux Linux3bce44b344040e5eef3d64d38b157c15304c0aab, 5017c302ca4b2a45149ad64e058fa2d5623c068f, 21167bf70dbe400563e189ac632258d35eda38b5, 55c0ced59fe17dee34e9dfd5f7be63cbab207758 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | ec0e2da95f72d4a46050a4d994e4fe471474fd80 ≤ v < 3bce44b344040e5eef3d64d38b157c15304c0aab, ec0e2da95f72d4a46050a4d994e4fe471474fd80 ≤ v < 5017c302ca4b2a45149ad64e058fa2d5623c068f, ec0e2da95f72d4a46050a4d994e4fe471474fd80 ≤ v < 21167bf70dbe400563e189ac632258d35eda38b5, ec0e2da95f72d4a46050a4d994e4fe471474fd80 ≤ v < 55c0ced59fe17dee34e9dfd5f7be63cbab207758, 6.6 | 3bce44b344040e5eef3d64d38b157c15304c0aab, 5017c302ca4b2a45149ad64e058fa2d5623c068f, 21167bf70dbe400563e189ac632258d35eda38b5, 55c0ced59fe17dee34e9dfd5f7be63cbab207758 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.