# CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility

> A missing check in the Linux kernel BPF subsystem allows a NULL pointer dereference via tailcalls, leading to a denial of service.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 12 Nov 2025
- **Updated:** 15 Oct 2026
- **Also known as:** BELL-CVE-2025-40123, DEBIAN-CVE-2025-40123, GHSA-f5hr-qj5q-hc8f, ROOT-OS-DEBIAN-11-CVE-2025-40123, ROOT-OS-UBUNTU-2204-CVE-2025-40123, ROOT-OS-UBUNTU-2404-CVE-2025-40123, UBUNTU-CVE-2025-40123

## What is CVE-2025-40123?

CVE-2025-40123 is a high-severity vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Enforce expected_attach_type for tailcall compatibility

Yinhao et al. recently reported:

  Our fuzzer tool discovered an uninitialized pointer issue in the
  bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
  This leads to a NULL pointer dereference when a BPF program attempts to
  deference the txq member of struct xdp_buff object.

The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
egress_ifindex, and the latter is only allowed to be accessed under mentioned
expected_attach_type. progB is then inserted into the tailcall which progA
calls.

The underlying issue goes beyond XDP though. Another example are programs
of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
as sock_addr_func_proto() have different logic depending on the programs'
expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
should not be allowed doing a tailcall into a program which calls bpf_bind()
out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.

In short, specifying expected_attach_type allows to open up additional
functionality or restrictions beyond what the basic bpf_prog_type enables.
The use of tailcalls must not violate these constraints. Fix it by enforcing
expected_attach_type in __bpf_prog_map_compatible().

Note that we only enforce this for tailcall maps, but not for BPF devmaps or
cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
these situations are not prone to this issue.

## Which versions are affected by CVE-2025-40123?


## How do I fix CVE-2025-40123?

Apply the vendor's patch.

## Is CVE-2025-40123 being exploited?

There is no known exploitation of CVE-2025-40123 in the wild and no public exploit code.

Public exploit code:

- Patch: Deserialization RCE (Veeam Backup) (github_poc): https://github.com/gduma-phData/patch-CVE-2025-40123

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-40123 and fix it if it is affected.

What it is: CVE-2025-40123 is a high-severity vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-40123 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-40123/ (Markdown: https://insights.sbomify.com/CVE-2025-40123/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-40123
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-40123
- OSV: https://osv.dev/vulnerability/CVE-2025-40123

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-40123/
Summaries are generated and may contain mistakes; the official description above is the record.