{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-40079 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-40079 is a high-severity memory corruption vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-40079 and fix it if it is affected.\n\nWhat it is: CVE-2025-40079 is a high-severity memory corruption vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-40079 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-40079/ (Markdown: https://insights.sbomify.com/CVE-2025-40079/index.md)","id":"CVE-2025-40079","markdown":"https://insights.sbomify.com/CVE-2025-40079/index.md","name":"CVE-2025-40079","record":{"aliases":["BELL-CVE-2025-40079","DEBIAN-CVE-2025-40079","GHSA-hw24-w8rj-6q65","ROOT-OS-DEBIAN-13-CVE-2025-40079","ROOT-OS-UBUNTU-2404-CVE-2025-40079","UBUNTU-CVE-2025-40079"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A missing sign extension in the RISC-V BPF JIT compiler causes kernel panics when executing specific BPF struct operations.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv, bpf: Sign extend struct ops return values properly\n\nThe ns_bpf_qdisc selftest triggers a kernel panic:\n\n    Unable to handle kernel paging request at virtual address ffffffffa38dbf58\n    Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000\n    [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000\n    Oops [#1]\n    Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]\n    CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G        W  OE       6.17.0-rc1-g2465bb83e0b4 #1 NONE\n    Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n    Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024\n    epc : __qdisc_run+0x82/0x6f0\n     ra : __qdisc_run+0x6e/0x6f0\n    epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550\n     gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180\n     t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0\n     s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001\n     a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000\n     a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049\n     s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000\n     s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0\n     s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000\n     s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000\n     t5 : 0000000000000000 t6 : ff60000093a6a8b6\n    status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d\n    [\u003cffffffff80bd5c7a\u003e] __qdisc_run+0x82/0x6f0\n    [\u003cffffffff80b6fe58\u003e] __dev_queue_xmit+0x4c0/0x1128\n    [\u003cffffffff80b80ae0\u003e] neigh_resolve_output+0xd0/0x170\n    [\u003cffffffff80d2daf6\u003e] ip6_finish_output2+0x226/0x6c8\n    [\u003cffffffff80d31254\u003e] ip6_finish_output+0x10c/0x2a0\n    [\u003cffffffff80d31446\u003e] ip6_output+0x5e/0x178\n    [\u003cffffffff80d2e232\u003e] ip6_xmit+0x29a/0x608\n    [\u003cffffffff80d6f4c6\u003e] inet6_csk_xmit+0xe6/0x140\n    [\u003cffffffff80c985e4\u003e] __tcp_transmit_skb+0x45c/0xaa8\n    [\u003cffffffff80c995fe\u003e] tcp_connect+0x9ce/0xd10\n    [\u003cffffffff80d66524\u003e] tcp_v6_connect+0x4ac/0x5e8\n    [\u003cffffffff80cc19b8\u003e] __inet_stream_connect+0xd8/0x318\n    [\u003cffffffff80cc1c36\u003e] inet_stream_connect+0x3e/0x68\n    [\u003cffffffff80b42b20\u003e] __sys_connect_file+0x50/0x88\n    [\u003cffffffff80b42bee\u003e] __sys_connect+0x96/0xc8\n    [\u003cffffffff80b42c40\u003e] __riscv_sys_connect+0x20/0x30\n    [\u003cffffffff80e5bcae\u003e] do_trap_ecall_u+0x256/0x378\n    [\u003cffffffff80e69af2\u003e] handle_exception+0x14a/0x156\n    Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709\n    ---[ end trace 0000000000000000 ]---\n\nThe bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer\nis treated as a 32bit value and sign extend to 64bit in epilogue. This\nbehavior is right for most bpf prog types but wrong for struct ops which\nrequires RISC-V ABI.\n\nSo let's sign extend struct ops return values according to the function\nmodel and RISC-V ABI([0]).\n\n  [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"riscv, bpf: Sign extend struct ops return values properly","id":"CVE-2025-40079","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2025"},"n_packages":0,"n_references":3,"next":{"headline":"nbd: restrict sockets to TCP and UDP","id":"CVE-2025-40080"},"packages":[],"prev":{"headline":"bpf: Explicitly check accesses to bpf_sock_addr","id":"CVE-2025-40078"},"products":["Linux"],"published":"2025-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A missing sign extension in the RISC-V BPF JIT compiler causes kernel panics when executing specific BPF struct operations.","url":"https://insights.sbomify.com/CVE-2025-40079/"}