CVE-2025-40169

A validation logic error was found in the Linux kernel's BPF verifier when checking ALU operation offsets. A local user with BPF privileges can trigger this issue by loading BPF programs containing ALU instructions with negative offset values. The verifier's check only rejected offsets greater than 1, incorrectly accepting all negative values due to signed comparison semantics. This allows malformed BPF programs to pass verification and potentially cause undefined behavior or crashes, resulting in denial of service.

BPF ALU instructions include a signed 16-bit offset field that should only be 0 or 1 (the latter for BPF_MOD/BPF_DIV operations). The check_alu_op verifier function used 'insn->off > 1' to validate this. Because insn->off is a signed s16, this comparison incorrectly accepts negative values—for example, -1 is not > 1 so it passes. The fix changes the condition to explicitly check '(insn->off != 0 && insn->off != 1)', rejecting any value outside the permitted set including all negatives. This hardens the verifier against malformed programs that might exploit unexpected offset values.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.