Skip to main content

Linux Kernel CVE-2025-40151

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.5 MEDIUM

Local BPF-load privilege needed (AV:L/PR:L); reliable oops trigger (AC:L); impact is a kernel crash/DoS only, so C:N/I:N/A:H rather than the input's C:H/I:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 09:00 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 08:59 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: No support of struct argument in trampoline programs

The current implementation does not support struct argument. This causes a oops when running bpf selftest:

$ ./test_progs -a tracing_struct Oops[#1]: CPU -1 Unable to handle kernel paging request at virtual address 0000000000000018, era 9000000085bef268, ra 90000000844f3938 rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 1-...0: (19 ticks this GP) idle=1094/1/0x4000000000000000 softirq=1380/1382 fqs=801 rcu: (detected by 0, t=5252 jiffies, g=1197, q=52 ncpus=4) Sending NMI from CPU 0 to CPUs 1: rcu: rcu_preempt kthread starved for 2495 jiffies! g1197 f0x0 RCU_GP_DOING_FQS(6) ->state=0x0 ->cpu=2 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:I stack:0 pid:15 tgid:15 ppid:2 task_flags:0x208040 flags:0x00000800 Stack : 9000000100423e80 0000000000000402 0000000000000010 90000001003b0680 9000000085d88000 0000000000000000 0000000000000040 9000000087159350 9000000085c2b9b0 0000000000000001 900000008704a000 0000000000000005 00000000ffff355b 00000000ffff355b 0000000000000000 0000000000000004 9000000085d90510 0000000000000000 0000000000000002 7b5d998f8281e86e 00000000ffff355c 7b5d998f8281e86e 000000000000003f 9000000087159350 900000008715bf98 0000000000000005 9000000087036000 900000008704a000 9000000100407c98 90000001003aff80 900000008715c4c0 9000000085c2b9b0 00000000ffff355b 9000000085c33d3c 00000000000000b4 0000000000000000 9000000007002150 00000000ffff355b 9000000084615480 0000000007000002 ... Call Trace: [<9000000085c2a868>] __schedule+0x410/0x1520 [<9000000085c2b9ac>] schedule+0x34/0x190 [<9000000085c33d38>] schedule_timeout+0x98/0x140 [<90000000845e9120>] rcu_gp_fqs_loop+0x5f8/0x868 [<90000000845ed538>] rcu_gp_kthread+0x260/0x2e0 [<900000008454e8a4>] kthread+0x144/0x238 [<9000000085c26b60>] ret_from_kernel_thread+0x28/0xc8 [<90000000844f20e4>] ret_from_kernel_thread_asm+0xc/0x88

rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 2: NMI backtrace for cpu 2 skipped: idling at idle_exit+0x0/0x4

Reject it for now.

AnalysisAI

Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.

Technical ContextAI

The bug is in the LoongArch architecture-specific BPF trampoline generator, the component that builds the small assembly stub connecting BPF tracing programs (BPF_TRAMP_FENTRY/FEXIT, used by fentry/fexit and struct_ops attachments) to kernel functions. BPF trampolines must marshal the traced function's arguments onto a save area so the BPF program can read them; when a kernel function takes a struct passed by value, the arguments occupy multiple registers/stack slots and require special layout logic. The LoongArch JIT simply lacked that logic, producing a stub that computes a bad pointer - the oops shows a paging request for a near-null address (0x18), i.e. a NULL/offset dereference (CWE-476-class root cause; the CVE lists CWE as N/A). The fix, delivered as two stable-tree commits (d115855... and e82406c...), does not add struct support but defensively rejects attachment when a struct-by-value argument is present, preventing generation of the faulty trampoline.

Affected ProductsAI

The Linux kernel on the LoongArch architecture is affected; other architectures do not use this trampoline code path and are unaffected. The CVE description does not enumerate exact version ranges and no CPE strings were provided, so affected releases must be inferred from the stable-tree fix commits at https://git.kernel.org/stable/c/d1158559315143e11bfaabcd4b2bea98c7ed1be9 and https://git.kernel.org/stable/c/e82406c7cbdd368c5459b8a45e118811d2ba0794 - the vulnerable window spans LoongArch kernels that shipped BPF trampoline support up to the commit that introduces the struct-argument rejection.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that includes stable commits d1158559315143e11bfaabcd4b2bea98c7ed1be9 and e82406c7cbdd368c5459b8a45e118811d2ba0794 (see the git.kernel.org links) by updating to your distribution's patched LoongArch kernel once tagged. As a compensating control until patched, restrict who can load BPF trampoline/tracing programs: ensure kernel.unprivileged_bpf_disabled=1 (or 2) so unprivileged users cannot attach BPF, and limit CAP_BPF/CAP_PERFMON/CAP_SYS_ADMIN to trusted operators - the trade-off is that legitimate observability/tracing tooling that relies on fentry/fexit or struct_ops on LoongArch will be blocked. Avoid attaching fentry/fexit programs to kernel functions that take struct-by-value arguments on unpatched LoongArch systems, since that is the specific trigger. This only matters on LoongArch hosts; no action is required on other architectures.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40151 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy