CVE-2025-40078 bpf: Explicitly check accesses to bpf_sock_addr
A missing validation check in the Linux kernel BPF subsystem allows local attackers to trigger a verifier bug and kernel warning, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40078?
CVE-2025-40078 is a missing authorization vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Explicitly check accesses to bpf_sock_addr
Syzkaller found a kernel warning on the following sock_addr program:
0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit
which triggers:
verifier bug: error during ctx access conversion (0)
This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access.
This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access.
I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
Which versions are affected by CVE-2025-40078?
How do I fix CVE-2025-40078?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-40078 being exploited?
There is no known exploitation of CVE-2025-40078 in the wild and no public exploit code.
Sources
Also known as AZL-68840, BELL-CVE-2025-40078, DEBIAN-CVE-2025-40078, GHSA-rvq5-xw4g-6wj7, ROOT-OS-DEBIAN-11-CVE-2025-40078, ROOT-OS-DEBIAN-12-CVE-2025-40078 and 4 more.