CVE-2025-40078

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Explicitly check accesses to bpf_sock_addr

Syzkaller found a kernel warning on the following sock_addr program:

0: r0 = 0

1: r2 = *(u32 *)(r1 +60)

2: exit

which triggers:

verifier bug: error during ctx access conversion (0)

This is happening because offset 60 in bpf_sock_addr corresponds to an

implicit padding of 4 bytes, right after msg_src_ip4. Access to this

padding isn't rejected in sock_addr_is_valid_access and it thus later

fails to convert the access.

This patch fixes it by explicitly checking the various fields of

bpf_sock_addr in sock_addr_is_valid_access.

I checked the other ctx structures and is_valid_access functions and

didn't find any other similar cases. Other cases of (properly handled)

padding are covered in new tests in a subsequent patch.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References