CVE-2025-40169bpf: Reject negative offsets for ALU ops
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ec0e2da95f72d4a46050a4d994e4fe471474fd80 before 3bce44b344040e5eef3d64d38b157c15304c0aab; from ec0e2da95f72d4a46050a4d994e4fe471474fd80 before 5017c302ca4b2a45149ad64e058fa2d5623c068f; from ec0e2da95f72d4a46050a4d994e4fe471474fd80 before 21167bf70dbe400563e189ac632258d35eda38b5; from ec0e2da95f72d4a46050a4d994e4fe471474fd80 before 55c0ced59fe17dee34e9dfd5f7be63cbab207758 | CNA record |
References
- https://git.kernel.org/stable/c/3bce44b344040e5eef3d64d38b157c15304c0aab
- https://git.kernel.org/stable/c/5017c302ca4b2a45149ad64e058fa2d5623c068f
- https://git.kernel.org/stable/c/21167bf70dbe400563e189ac632258d35eda38b5
- https://git.kernel.org/stable/c/55c0ced59fe17dee34e9dfd5f7be63cbab207758
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.