{"id":"CVE-2025-40169","revision":"a302d7b97600492199bc45c6c714c675","records":[{"revision":"a302d7b97600492199bc45c6c714c675","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-40169","aliases":[],"title":"bpf: Reject negative offsets for ALU ops","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject negative offsets for ALU ops\n\nWhen verifying BPF programs, the check_alu_op() function validates\ninstructions with ALU operations. The 'offset' field in these\ninstructions is a signed 16-bit integer.\n\nThe existing check 'insn->off > 1' was intended to ensure the offset is\neither 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is\nsigned, this check incorrectly accepts all negative values (e.g., -1).\n\nThis commit tightens the validation by changing the condition to\n'(insn->off != 0 && insn->off != 1)'. This ensures that any value\nother than the explicitly permitted 0 and 1 is rejected, hardening the\nverifier against malformed BPF programs.","state":0,"publishedAt":"2025-11-12T10:46:51.736+00:00","modifiedAt":"2026-10-15T22:02:39.32+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/verifier.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ec0e2da95f72d4a46050a4d994e4fe471474fd80\",\n                            \"lessThan\": \"3bce44b344040e5eef3d64d38b157c15304c0aab\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec0e2da95f72d4a46050a4d994e4fe471474fd80\",\n                            \"lessThan\": \"5017c302ca4b2a45149ad64e058fa2d5623c068f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec0e2da95f72d4a46050a4d994e4fe471474fd80\",\n                            \"lessThan\": \"21167bf70dbe400563e189ac632258d35eda38b5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec0e2da95f72d4a46050a4d994e4fe471474fd80\",\n                            \"lessThan\": \"55c0ced59fe17dee34e9dfd5f7be63cbab207758\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/verifier.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.112\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.53\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17.3\",\n                            \"lessThanOrEqual\": \"6.17.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/3bce44b344040e5eef3d64d38b157c15304c0aab","https://git.kernel.org/stable/c/5017c302ca4b2a45149ad64e058fa2d5623c068f","https://git.kernel.org/stable/c/21167bf70dbe400563e189ac632258d35eda38b5","https://git.kernel.org/stable/c/55c0ced59fe17dee34e9dfd5f7be63cbab207758"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40169","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-40169","identifiers":["CVE-2025-40169"]},"retained":false,"historicalAffected":[]}],"coverage":[]}