CVE-2025-40143

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: dont report verifier bug for missing bpf_scc_visit on speculative path

Syzbot generated a program that triggers a verifier_bug() call in

maybe_exit_scc(). maybe_exit_scc() assumes that, when called for a

state with insn_idx in some SCC, there should be an instance of struct

bpf_scc_visit allocated for that SCC. Turns out the assumption does

not hold for speculative execution paths. See example in the next

patch.

maybe_scc_exit() is called from update_branch_counts() for states that

reach branch count of zero, meaning that path exploration for a

particular path is finished. Path exploration can finish in one of

three ways:

a. Verification error is found. In this case, update_branch_counts()

is called only for non-speculative paths.

b. Top level BPF_EXIT is reached. Such instructions are never a part of

an SCC, so compute_scc_callchain() in maybe_scc_exit() will return

false, and maybe_scc_exit() will re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References