CVE-2025-40143

{
  "id": "CVE-2025-40143",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-11-12T11:15:44.130",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: dont report verifier bug for missing bpf_scc_visit on speculative path\n\nSyzbot generated a program that triggers a verifier_bug() call in\nmaybe_exit_scc(). maybe_exit_scc() assumes that, when called for a\nstate with insn_idx in some SCC, there should be an instance of struct\nbpf_scc_visit allocated for that SCC. Turns out the assumption does\nnot hold for speculative execution paths. See example in the next\npatch.\n\nmaybe_scc_exit() is called from update_branch_counts() for states that\nreach branch count of zero, meaning that path exploration for a\nparticular path is finished. Path exploration can finish in one of\nthree ways:\na. Verification error is found. In this case, update_branch_counts()\n   is called only for non-speculative paths.\nb. Top level BPF_EXIT is reached. Such instructions are never a part of\n   an SCC, so compute_scc_callchain() in maybe_scc_exit() will return\n   false, and maybe_scc_exit() will return early.\nc. A checkpoint is reached and matched. Checkpoints are created by\n   is_state_visited(), which calls maybe_enter_scc(), which allocates\n   bpf_scc_visit instances for checkpoints within SCCs.\n\nHence, for non-speculative symbolic execution paths, the assumption\nstill holds: if maybe_scc_exit() is called for a state within an SCC,\nbpf_scc_visit instance must exist.\n\nThis patch removes the verifier_bug() call for speculative paths."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: no reportar error del verificador por bpf_scc_visit faltante en ruta especulativa\n\nSyzbot generó un programa que activa una llamada a verifier_bug() en maybe_exit_scc(). maybe_exit_scc() asume que, cuando se llama para un estado con insn_idx en algún SCC, debería haber una instancia de la estructura bpf_scc_visit asignada para ese SCC. Resulta que la suposición no se cumple para rutas de ejecución especulativa. Ver ejemplo en el siguiente parche.\n\nmaybe_scc_exit() es llamada desde update_branch_counts() para estados que alcanzan un recuento de ramas de cero, lo que significa que la exploración de rutas para una ruta particular ha terminado. La exploración de rutas puede terminar de una de tres maneras:\na. Se encuentra un error de verificación. En este caso, update_branch_counts() es llamada solo para rutas no especulativas.\nb. Se alcanza un BPF_EXIT de nivel superior. Dichas instrucciones nunca forman parte de un SCC, por lo que compute_scc_callchain() en maybe_scc_exit() devolverá falso, y maybe_scc_exit() regresará anticipadamente.\nc. Se alcanza y se empareja un punto de control. Los puntos de control son creados por is_state_visited(), que llama a maybe_enter_scc(), que asigna instancias de bpf_scc_visit para puntos de control dentro de los SCC.\n\nPor lo tanto, para rutas de ejecución simbólica no especulativas, la suposición aún se mantiene: si maybe_scc_exit() es llamada para un estado dentro de un SCC, la instancia de bpf_scc_visit debe existir.\n\nEste parche elimina la llamada a verifier_bug() para rutas especulativas."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "c9e31900b54cadf5398dfb838c0a63effa1defec",
              "lessThan": "3861e7c4324aa20a632fb74eb3904114f6afdb57",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c9e31900b54cadf5398dfb838c0a63effa1defec",
              "lessThan": "a3c73d629ea1373af3c0c954d41fd1af555492e3",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.17",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.17",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.3",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3861e7c4324aa20a632fb74eb3904114f6afdb57",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3c73d629ea1373af3c0c954d41fd1af555492e3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}