What is the CVSS score of CVE-2025-40079?

CVE-2025-40079 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2025-40079?

A Linux kernel vulnerability (CVE-2025-40079) in the BPF JIT compiler on RISC-V architecture enables a local privileged user to trigger kernel panic and potential memory corruption, resulting in…. A patch is available.

How to fix or mitigate CVE-2025-40079?

Within 24 hours, audit your infrastructure to identify any RISC-V systems running Linux with BPF qdisc or struct_ops features enabled; document findings and assign risk owners. Within 7 days, implement mitigations on affected systems by either disabling BPF qdisc features entirely, restricting local administrative access to trusted accounts only, or network-segmenting vulnerable hosts to administrative-only access. Within 30 days, subscribe to Linux kernel security advisories and RISC-V vendor channels; apply patches immediately upon release. Standard x86 and ARM deployments require no remediation.

Linux Kernel CVE-2025-40079

HIGH

2025-10-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.4 MEDIUM

Loading a BPF struct_ops qdisc needs CAP_BPF/CAP_NET_ADMIN (PR:H), local vector, and the demonstrated effect is a kernel crash (A:H) with no proven confidentiality/integrity impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 07:45 vuln.today

CVE Published

Oct 28, 2025 - 12:15 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

riscv, bpf: Sign extend struct ops return values properly

The ns_bpf_qdisc selftest triggers a kernel panic:

Unable to handle kernel paging request at virtual address ffffffffa38dbf58 Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000 Oops [#1] Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)] CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 epc : __qdisc_run+0x82/0x6f0 ra : __qdisc_run+0x6e/0x6f0 epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 t5 : 0000000000000000 t6 : ff60000093a6a8b6 status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0 [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128 [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170 [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8 [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0 [<ffffffff80d31446>] ip6_output+0x5e/0x178 [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608 [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140 [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8 [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10 [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8 [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318 [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68 [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88 [<ffffffff80b42bee>] __sys_connect+0x96/0xc8 [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30 [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378 [<ffffffff80e69af2>] handle_exception+0x14a/0x156 Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 ---[ end trace 0000000000000000 ]---

The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires RISC-V ABI.

So let's sign extend struct ops return values according to the function model and RISC-V ABI([0]).

[0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf

AnalysisAI

Kernel panic (and potential memory corruption) in the Linux kernel BPF JIT on the RISC-V architecture allows a local privileged actor to crash the system when a BPF struct_ops program (such as a bpf_qdisc scheduler) returns a pointer. The RISC-V JIT epilogue sign-extended struct_ops return values as if they were 32-bit scalars, violating the RISC-V calling convention and corrupting the returned 64-bit pointer, which the network qdisc path then dereferences. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this affects only RISC-V builds using the BPF qdisc/struct_ops feature.

Technical ContextAI

The issue lives in the RISC-V BPF JIT compiler (arch/riscv/net) within the Linux kernel's eBPF subsystem. eBPF struct_ops lets programs implement kernel operation tables - here a bpf_qdisc (BPF-based queueing discipline) whose bpf_fifo_dequeue callback returns an sk_buff pointer. For ordinary BPF program types the JIT epilogue sign-extends the 32-bit result register to 64 bits, which is correct for scalar return values, but struct_ops callbacks must follow the native RISC-V ABI (the RISC-V calling convention specifies how 64-bit values are held in registers). Sign-extending a 64-bit pointer as a 32-bit value corrupts its upper bits, so __qdisc_run then dereferences a bogus address (badaddr ffffffffa38dbf58, cause 0xd = load page fault) and oopses. The root cause is an ABI/return-value width mismatch in code generation; NVD assigns no CWE, but the class is best described as incorrect calculation/truncation of a pointer value (akin to CWE-681/CWE-704 improper type conversion) leading to invalid pointer dereference.

Affected ProductsAI

The Linux kernel is affected only in RISC-V (riscv64) builds that use the eBPF struct_ops feature, specifically the bpf_qdisc path; the crash reproduced on kernel 6.17.0-rc1 (commit 2465bb83e0b4) via the ns_bpf_qdisc selftest. No CPE strings were supplied in the intelligence feed. The fix is tracked across three stable-tree commits at git.kernel.org: 918a399501e28e0cc36dbd1fcfb4208f8aa1e4d1, 92751937f12a7d34ad492577a251c94a55e97e72, and fd2e08128944a7679e753f920e9eda72057e427c; the presence of multiple stable commits indicates the fix was backported to more than one maintained series, though exact fixed release tags were not provided in the input.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that includes commits 918a399501e28e0cc36dbd1fcfb4208f8aa1e4d1, 92751937f12a7d34ad492577a251c94a55e97e72, or fd2e08128944a7679e753f920e9eda72057e427c (see https://git.kernel.org/stable/c/918a399501e28e0cc36dbd1fcfb4208f8aa1e4d1). Rebuild/update your RISC-V kernel to a stable release incorporating these commits once your distribution tags one. As a compensating control on unpatched RISC-V hosts, restrict the ability to load BPF struct_ops/qdisc programs: keep unprivileged BPF disabled (sysctl kernel.unprivileged_bpf_disabled=1, which is default on most modern kernels) and withhold CAP_BPF/CAP_NET_ADMIN from untrusted workloads and containers - the trade-off is that legitimate BPF-based traffic-shaping or observability tooling that needs those capabilities will be blocked. Non-RISC-V systems require no action for this specific defect.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2025-40079 vulnerability details – vuln.today

Back

Linux Kernel CVE-2025-40079

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code