{"id":"CVE-2025-40169","title":"bpf: Reject negative offsets for ALU ops","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject negative offsets for ALU ops\n\nWhen verifying BPF programs, the check_alu_op() function validates\ninstructions with ALU operations. The 'offset' field in the…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 3bce44b344040e5eef3d64d38b157c15304c0aab","Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 5017c302ca4b2a45149ad64e058fa2d5623c068f","Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 21167bf70dbe400563e189ac632258d35eda38b5","Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 55c0ced59fe17dee34e9dfd5f7be63cbab207758","Linux 6.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:57:30.151635Z"},"published":"2025-11-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:39.320Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40169","references":[{"url":"https://git.kernel.org/stable/c/3bce44b344040e5eef3d64d38b157c15304c0aab"},{"url":"https://git.kernel.org/stable/c/5017c302ca4b2a45149ad64e058fa2d5623c068f"},{"url":"https://git.kernel.org/stable/c/21167bf70dbe400563e189ac632258d35eda38b5"},{"url":"https://git.kernel.org/stable/c/55c0ced59fe17dee34e9dfd5f7be63cbab207758"}],"tags":["cve.org"],"epss":0.00153,"epssPercentile":0.03959,"ingestedAt":"2026-10-15T22:48:25.548Z","slug":"CVE-2025-40169","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject negative offsets for ALU ops\n\nWhen verifying BPF programs, the check_alu_op() function validates\ninstructions with ALU operations. The 'offset' field in these\ninstructions is a signed 16-bit integer.\n\nThe existing check 'insn->off > 1' was intended to ensure the offset is\neither 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is\nsigned, this check incorrectly accepts all negative values (e.g., -1).\n\nThis commit tightens the validation by changing the condition to\n'(insn->off != 0 && insn->off != 1)'. This ensures that any value\nother than the explicitly permitted 0 and 1 is rejected, hardening the\nverifier against malformed BPF programs.\n\n## Affected\n\n- `Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 3bce44b344040e5eef3d64d38b157c15304c0aab`\n- `Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 5017c302ca4b2a45149ad64e058fa2d5623c068f`\n- `Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 21167bf70dbe400563e189ac632258d35eda38b5`\n- `Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 55c0ced59fe17dee34e9dfd5f7be63cbab207758`\n- `Linux 6.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}