CVE-2025-40078

A vulnerability was discovered in the Linux kernel’s Berkeley Packet Filter (BPF) subsystem related to insufficient access validation in the sock_addr context. The BPF verifier did not explicitly reject access to a 4-byte implicit padding following the msg_src_ip4 field within the bpf_sock_addr structure. Syzkaller, a kernel testing and fuzzing tool, identified a kernel warning triggered when a BPF program attempted to read from this padding, revealing that the sock_addr_is_valid_access function did not enforce a complete set of bounds checks. A patch has been applied upstream to explicitly validate all relevant fields and prevent out-of-bounds access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict unprivileged users from loading BPF programs by setting kernel.unprivileged_bpf_disabled to 1. This can be achieved by running sysctl -w kernel.unprivileged_bpf_disabled=1 or by adding kernel.unprivileged_bpf_disabled = 1 to /etc/sysctl.d/99-sysctl.conf and applying with sysctl -p. This may affect applications that utilize unprivileged BPF. A system reboot may be required.