{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-40041",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T07:20:57.154Z",
        "datePublished": "2025-10-28T11:48:21.021Z",
        "dateUpdated": "2026-08-05T12:07:15.168Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:07:15.168Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Sign-extend struct ops return values properly\n\nThe ns_bpf_qdisc selftest triggers a kernel panic:\n\n  Oops[#1]:\n  CPU 0 Unable to handle kernel paging request at virtual address 0000000000741d58, era == 90000000851b5ac0, ra == 90000000851b5aa4\n  CPU: 0 UID: 0 PID: 449 Comm: test_progs Tainted: G           OE       6.16.0+ #3 PREEMPT(full)\n  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022\n  pc 90000000851b5ac0 ra 90000000851b5aa4 tp 90000001076b8000 sp 90000001076bb600\n  a0 0000000000741ce8 a1 0000000000000001 a2 90000001076bb5c0 a3 0000000000000008\n  a4 90000001004c4620 a5 9000000100741ce8 a6 0000000000000000 a7 0100000000000000\n  t0 0000000000000010 t1 0000000000000000 t2 9000000104d24d30 t3 0000000000000001\n  t4 4f2317da8a7e08c4 t5 fffffefffc002f00 t6 90000001004c4620 t7 ffffffffc61c5b3d\n  t8 0000000000000000 u0 0000000000000001 s9 0000000000000050 s0 90000001075bc800\n  s1 0000000000000040 s2 900000010597c400 s3 0000000000000008 s4 90000001075bc880\n  s5 90000001075bc8f0 s6 0000000000000000 s7 0000000000741ce8 s8 0000000000000000\n     ra: 90000000851b5aa4 __qdisc_run+0xac/0x8d8\n    ERA: 90000000851b5ac0 __qdisc_run+0xc8/0x8d8\n   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n   PRMD: 00000004 (PPLV0 +PIE -PWE)\n   EUEN: 00000007 (+FPE +SXE +ASXE -BTE)\n   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\n  ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\n   BADV: 0000000000741d58\n   PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)\n  Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)]\n  Process test_progs (pid: 449, threadinfo=000000009af02b3a, task=00000000e9ba4956)\n  Stack : 0000000000000000 90000001075bc8ac 90000000869524a8 9000000100741ce8\n          90000001075bc800 9000000100415300 90000001075bc8ac 0000000000000000\n          900000010597c400 900000008694a000 0000000000000000 9000000105b59000\n          90000001075bc800 9000000100741ce8 0000000000000050 900000008513000c\n          9000000086936000 0000000100094d4c fffffff400676208 0000000000000000\n          9000000105b59000 900000008694a000 9000000086bf0dc0 9000000105b59000\n          9000000086bf0d68 9000000085147010 90000001075be788 0000000000000000\n          9000000086bf0f98 0000000000000001 0000000000000010 9000000006015840\n          0000000000000000 9000000086be6c40 0000000000000000 0000000000000000\n          0000000000000000 4f2317da8a7e08c4 0000000000000101 4f2317da8a7e08c4\n          ...\n  Call Trace:\n  [<90000000851b5ac0>] __qdisc_run+0xc8/0x8d8\n  [<9000000085130008>] __dev_queue_xmit+0x578/0x10f0\n  [<90000000853701c0>] ip6_finish_output2+0x2f0/0x950\n  [<9000000085374bc8>] ip6_finish_output+0x2b8/0x448\n  [<9000000085370b24>] ip6_xmit+0x304/0x858\n  [<90000000853c4438>] inet6_csk_xmit+0x100/0x170\n  [<90000000852b32f0>] __tcp_transmit_skb+0x490/0xdd0\n  [<90000000852b47fc>] tcp_connect+0xbcc/0x1168\n  [<90000000853b9088>] tcp_v6_connect+0x580/0x8a0\n  [<90000000852e7738>] __inet_stream_connect+0x170/0x480\n  [<90000000852e7a98>] inet_stream_connect+0x50/0x88\n  [<90000000850f2814>] __sys_connect+0xe4/0x110\n  [<90000000850f2858>] sys_connect+0x18/0x28\n  [<9000000085520c94>] do_syscall+0x94/0x1a0\n  [<9000000083df1fb8>] handle_syscall+0xb8/0x158\n\n  Code: 4001ad80  2400873f  2400832d <240073cc> 001137ff  001133ff  6407b41f  001503cc  0280041d\n\n  ---[ end trace 0000000000000000 ]---\n\nThe bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer\nis treated as a 32bit value and sign extend to 64bit in epilogue. This\nbehavior is right for most bpf prog types but wrong for struct ops which\nrequires LoongArch ABI.\n\nSo let's sign extend struct ops return values according to the LoongArch\nABI ([1]) and return value spec in function model.\n\n[1]: https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The defect is in the LoongArch BPF JIT struct_ops trampoline, reached by loading/attaching a struct_ops program through the bpf() syscall and driven by local syscalls — the reported oops originates from sys_connect() → __dev_queue_xmit → __qdisc_run. Per kernel guidance BPF is Local.\nAC:L - The miscompilation is deterministic: every invocation of a struct_ops callback with an 8-byte return type unconditionally truncates the value to 32 bits, with no race, timing window, or condition outside the attacker's control. Heap grooming further lets the attacker steer which address the sign-extended low word resolves to.\nPR:L - Attaching a struct_ops program needs CAP_BPF, which is delegable to unprivileged workloads via BPF tokens (bpf_token_capable() honours the token's userns); and on a machine already running a BPF qdisc, any unprivileged local user's ordinary network traffic drives the miscompiled dequeue callback, so real root in the init namespace is not required.\nUI:N - The corrupted return value is consumed by the kernel's own packet-transmit path the moment the attacker sends traffic; no action by any other user or administrator is needed at exploit time.\nS:U - The truncated pointer is dereferenced by kernel code within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The sign-extended low 32 bits of a direct-map pointer land below TASK_SIZE64 in the mmap-able user range, and LoongArch has no SMAP/PAN equivalent, so the kernel reads a fully attacker-controlled fake sk_buff (skb->len, queue_mapping, shinfo, data pointers) — a type confusion that yields arbitrary kernel-context reads and lets kernel data be pulled into transmitted packets.\nI:H - The transmit path writes through the confused pointer (try_bulk_dequeue_skb()'s skb->next = nskb, skb_mark_not_on_list(), requeue and stats updates) and later performs an indirect call via skb->destructor in kfree_skb(), giving both an arbitrary-write primitive and control-flow hijack.\nA:H - The commit documents a reproducible kernel panic — \"Unable to handle kernel paging request at virtual address 0000000000741d58\" in __qdisc_run+0xc8 — triggered by an ordinary connect(), taking the whole system down and repeatable at will."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "arch/loongarch/net/bpf_jit.c"
                    ],
                    "versions": [
                        {
                            "version": "6abf17d690d83d25f6d00a1a2cd3553c7d20c2d8",
                            "lessThan": "9f3169bb3c2967166b4f4433cf152a84f3eb95d0",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "6abf17d690d83d25f6d00a1a2cd3553c7d20c2d8",
                            "lessThan": "8b51b11b3d81c1ed48a52f87da9256d737b723a0",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "arch/loongarch/net/bpf_jit.c"
                    ],
                    "versions": [
                        {
                            "version": "6.17",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.17",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.17.3",
                            "lessThanOrEqual": "6.17.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.17",
                                    "versionEndExcluding": "6.17.3"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.17",
                                    "versionEndExcluding": "6.18"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/9f3169bb3c2967166b4f4433cf152a84f3eb95d0"
                },
                {
                    "url": "https://git.kernel.org/stable/c/8b51b11b3d81c1ed48a52f87da9256d737b723a0"
                }
            ],
            "title": "LoongArch: BPF: Sign-extend struct ops return values properly",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}