CVE-2025-40050 bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer
A flaw in the Linux kernel BPF verifier allows incorrect scalar adjustments for pointer registers, potentially enabling privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40050?
CVE-2025-40050 is a vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer
In check_alu_op(), the verifier currently calls check_reg_arg() and adjust_scalar_min_max_vals() unconditionally for BPF_NEG operations. However, if the destination register holds a pointer, these scalar adjustments are unnecessary and potentially incorrect.
This patch adds a check to skip the adjustment logic when the destination register contains a pointer.
Which versions are affected by CVE-2025-40050?
How do I fix CVE-2025-40050?
Apply the vendor's patch.
Is CVE-2025-40050 being exploited?
There is no known exploitation of CVE-2025-40050 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40050, GHSA-p3rp-6995-mvj3, UBUNTU-CVE-2025-40050.