---
id: CVE-2025-40169
title: 'bpf: Reject negative offsets for ALU ops'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Reject negative offsets for ALU ops

  When verifying BPF programs, the check_alu_op() function validates
  instructions with ALU operations. The 'offset' field in the…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 <
    3bce44b344040e5eef3d64d38b157c15304c0aab
  - >-
    Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 <
    5017c302ca4b2a45149ad64e058fa2d5623c068f
  - >-
    Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 <
    21167bf70dbe400563e189ac632258d35eda38b5
  - >-
    Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 <
    55c0ced59fe17dee34e9dfd5f7be63cbab207758
  - Linux 6.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:57:30.151635Z'
published: '2025-11-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:39.320Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40169'
references:
  - url: 'https://git.kernel.org/stable/c/3bce44b344040e5eef3d64d38b157c15304c0aab'
  - url: 'https://git.kernel.org/stable/c/5017c302ca4b2a45149ad64e058fa2d5623c068f'
  - url: 'https://git.kernel.org/stable/c/21167bf70dbe400563e189ac632258d35eda38b5'
  - url: 'https://git.kernel.org/stable/c/55c0ced59fe17dee34e9dfd5f7be63cbab207758'
tags:
  - cve.org
epss: 0.00153
epssPercentile: 0.03959
ingestedAt: '2026-10-15T22:48:25.548Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject negative offsets for ALU ops

When verifying BPF programs, the check_alu_op() function validates
instructions with ALU operations. The 'offset' field in these
instructions is a signed 16-bit integer.

The existing check 'insn->off > 1' was intended to ensure the offset is
either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is
signed, this check incorrectly accepts all negative values (e.g., -1).

This commit tightens the validation by changing the condition to
'(insn->off != 0 && insn->off != 1)'. This ensures that any value
other than the explicitly permitted 0 and 1 is rejected, hardening the
verifier against malformed BPF programs.

## Affected

- `Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 3bce44b344040e5eef3d64d38b157c15304c0aab`
- `Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 5017c302ca4b2a45149ad64e058fa2d5623c068f`
- `Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 21167bf70dbe400563e189ac632258d35eda38b5`
- `Linux >= ec0e2da95f72d4a46050a4d994e4fe471474fd80 < 55c0ced59fe17dee34e9dfd5f7be63cbab207758`
- `Linux 6.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.