CVE-2025-40123

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Enforce expected_attach_type for tailcall compatibility

Yinhao et al. recently reported:

Our fuzzer tool discovered an uninitialized pointer issue in the

bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.

This leads to a NULL pointer dereference when a BPF program attempts to

deference the txq member of struct xdp_buff object.

The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the

entry point for bpf_prog_test_run_xdp() and its expected_attach_type can

neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot

of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP

to pass xdp_is_valid_access() validation. The program returns struct xdp_md's

egress_ifindex, and the latter is only allowed to be accessed under mentioned

expected_attach_type. progB is then inserted into the tailcall which progA

calls.

The underlying issue g

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References