CVE-2025-40079 in Linux
Summary
by MITRE • 10/28/2025
In the Linux kernel, the following vulnerability has been resolved:
riscv, bpf: Sign extend struct ops return values properly
The ns_bpf_qdisc selftest triggers a kernel panic:
Unable to handle kernel paging request at virtual address ffffffffa38dbf58 Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000
Oops [#1]
Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]
CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 epc : __qdisc_run+0x82/0x6f0 ra : __qdisc_run+0x6e/0x6f0 epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 t5 : 0000000000000000 t6 : ff60000093a6a8b6 status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0
[<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128
[<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170
[<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8
[<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0
[<ffffffff80d31446>] ip6_output+0x5e/0x178
[<ffffffff80d2e232>] ip6_xmit+0x29a/0x608
[<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140
[<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8
[<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10
[<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8
[<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318
[<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68
[<ffffffff80b42b20>] __sys_connect_file+0x50/0x88
[<ffffffff80b42bee>] __sys_connect+0x96/0xc8
[<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30
[<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378
[<ffffffff80e69af2>] handle_exception+0x14a/0x156
Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 ---[ end trace 0000000000000000 ]---
The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires RISC-V ABI.
So let's sign extend struct ops return values according to the function model and RISC-V ABI([0]).
[0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/15/2026
The vulnerability described in CVE-2025-40079 resides within the Linux kernel's handling of BPF (Berkeley Packet Filter) programs, specifically affecting the RISC-V architecture. This issue manifests during the execution of the ns_bpf_qdisc selftest, which triggers a kernel panic due to improper handling of return values from BPF programs. The panic occurs when attempting to access a virtual address that results in a page fault, indicating a critical failure in memory management during BPF program execution. The error trace reveals that the problem originates from the __qdisc_run function, where a pointer returned by a BPF program is incorrectly processed as a 32-bit value before being sign-extended to 64-bit. This mismanagement leads to invalid memory access patterns that cause the kernel to crash.
The root cause of this vulnerability lies in the incorrect implementation of sign extension for return values in BPF struct ops programs on RISC-V systems. While the current implementation correctly handles most BPF program types by sign-extending 32-bit pointers to 64-bit values, it fails to account for the specific requirements of the RISC-V Application Binary Interface (ABI). The BPF program in question returns an skb (socket buffer) pointer, which should be processed according to RISC-V calling conventions rather than generic 32-bit to 64-bit sign extension rules. This discrepancy between expected ABI behavior and actual implementation creates a path for kernel memory corruption that can be exploited to cause system instability.
From a cybersecurity perspective, this vulnerability represents a critical kernel memory safety issue that aligns with CWE-129, which deals with improper validation of array indices, and CWE-128, which addresses signedness issues in arithmetic operations. The vulnerability's impact extends to the broader ATT&CK framework under the T1068 technique for privilege escalation and T1499 for endpoint denial of service. The flaw enables an attacker to potentially cause a kernel panic through controlled BPF program execution, which could be leveraged in a denial-of-service attack against systems running affected kernel versions. The issue specifically affects systems utilizing RISC-V architecture with BPF programs, making it particularly relevant for embedded systems, IoT devices, and servers implementing RISC-V instruction sets.
The recommended mitigation strategy involves applying the kernel patch that correctly implements RISC-V ABI-compliant sign extension for struct ops return values. This fix ensures that BPF programs return values are properly handled according to the RISC-V calling convention, specifically addressing how pointers are sign-extended from 32-bit to 64-bit representations. System administrators should prioritize updating their kernel versions to include this fix, particularly in environments where BPF programs are actively used for network filtering or traffic control. Additionally, organizations should monitor for any BPF-related applications or services that might be vulnerable to this specific ABI handling issue, as improper BPF program execution could lead to system instability or potential privilege escalation opportunities. The fix directly addresses the memory access violation by ensuring proper pointer handling according to RISC-V architecture specifications, thereby preventing the kernel panic scenario described in the vulnerability report.