CVE-2025-40079 (GCVE-0-2025-40079)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07
VLAI
Title
riscv, bpf: Sign extend struct ops return values properly
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Sign extend struct ops return values properly The ns_bpf_qdisc selftest triggers a kernel panic: Unable to handle kernel paging request at virtual address ffffffffa38dbf58 Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000 Oops [#1] Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)] CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 epc : __qdisc_run+0x82/0x6f0 ra : __qdisc_run+0x6e/0x6f0 epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 t5 : 0000000000000000 t6 : ff60000093a6a8b6 status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0 [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128 [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170 [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8 [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0 [<ffffffff80d31446>] ip6_output+0x5e/0x178 [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608 [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140 [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8 [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10 [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8 [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318 [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68 [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88 [<ffffffff80b42bee>] __sys_connect+0x96/0xc8 [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30 [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378 [<ffffffff80e69af2>] handle_exception+0x14a/0x156 Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 ---[ end trace 0000000000000000 ]--- The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires RISC-V ABI. So let's sign extend struct ops return values according to the function model and RISC-V ABI([0]). [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 25ad10658dc1068a671553ff10e19a812c2a3783 , < 92751937f12a7d34ad492577a251c94a55e97e72 (git)
Affected: 25ad10658dc1068a671553ff10e19a812c2a3783 , < 918a399501e28e0cc36dbd1fcfb4208f8aa1e4d1 (git)
Affected: 25ad10658dc1068a671553ff10e19a812c2a3783 , < fd2e08128944a7679e753f920e9eda72057e427c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/net/bpf_jit_comp64.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "92751937f12a7d34ad492577a251c94a55e97e72",
              "status": "affected",
              "version": "25ad10658dc1068a671553ff10e19a812c2a3783",
              "versionType": "git"
            },
            {
              "lessThan": "918a399501e28e0cc36dbd1fcfb4208f8aa1e4d1",
              "status": "affected",
              "version": "25ad10658dc1068a671553ff10e19a812c2a3783",
              "versionType": "git"
            },
            {
              "lessThan": "fd2e08128944a7679e753f920e9eda72057e427c",
              "status": "affected",
              "version": "25ad10658dc1068a671553ff10e19a812c2a3783",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/net/bpf_jit_comp64.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv, bpf: Sign extend struct ops return values properly\n\nThe ns_bpf_qdisc selftest triggers a kernel panic:\n\n    Unable to handle kernel paging request at virtual address ffffffffa38dbf58\n    Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000\n    [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000\n    Oops [#1]\n    Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]\n    CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G        W  OE       6.17.0-rc1-g2465bb83e0b4 #1 NONE\n    Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n    Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024\n    epc : __qdisc_run+0x82/0x6f0\n     ra : __qdisc_run+0x6e/0x6f0\n    epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550\n     gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180\n     t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0\n     s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001\n     a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000\n     a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049\n     s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000\n     s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0\n     s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000\n     s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000\n     t5 : 0000000000000000 t6 : ff60000093a6a8b6\n    status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d\n    [\u003cffffffff80bd5c7a\u003e] __qdisc_run+0x82/0x6f0\n    [\u003cffffffff80b6fe58\u003e] __dev_queue_xmit+0x4c0/0x1128\n    [\u003cffffffff80b80ae0\u003e] neigh_resolve_output+0xd0/0x170\n    [\u003cffffffff80d2daf6\u003e] ip6_finish_output2+0x226/0x6c8\n    [\u003cffffffff80d31254\u003e] ip6_finish_output+0x10c/0x2a0\n    [\u003cffffffff80d31446\u003e] ip6_output+0x5e/0x178\n    [\u003cffffffff80d2e232\u003e] ip6_xmit+0x29a/0x608\n    [\u003cffffffff80d6f4c6\u003e] inet6_csk_xmit+0xe6/0x140\n    [\u003cffffffff80c985e4\u003e] __tcp_transmit_skb+0x45c/0xaa8\n    [\u003cffffffff80c995fe\u003e] tcp_connect+0x9ce/0xd10\n    [\u003cffffffff80d66524\u003e] tcp_v6_connect+0x4ac/0x5e8\n    [\u003cffffffff80cc19b8\u003e] __inet_stream_connect+0xd8/0x318\n    [\u003cffffffff80cc1c36\u003e] inet_stream_connect+0x3e/0x68\n    [\u003cffffffff80b42b20\u003e] __sys_connect_file+0x50/0x88\n    [\u003cffffffff80b42bee\u003e] __sys_connect+0x96/0xc8\n    [\u003cffffffff80b42c40\u003e] __riscv_sys_connect+0x20/0x30\n    [\u003cffffffff80e5bcae\u003e] do_trap_ecall_u+0x256/0x378\n    [\u003cffffffff80e69af2\u003e] handle_exception+0x14a/0x156\n    Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709\n    ---[ end trace 0000000000000000 ]---\n\nThe bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer\nis treated as a 32bit value and sign extend to 64bit in epilogue. This\nbehavior is right for most bpf prog types but wrong for struct ops which\nrequires RISC-V ABI.\n\nSo let\u0027s sign extend struct ops return values according to the function\nmodel and RISC-V ABI([0]).\n\n  [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the RISC-V BPF JIT struct_ops trampoline, reached by loading/attaching a BPF struct_ops program via the bpf() syscall and triggered by local syscalls (the reported oops comes from connect()). Per kernel guidance BPF is Local.\nAC:L - The miscompilation is deterministic \u2014 every invocation of a struct_ops callback with an 8-byte return type truncates the value; no race, timing window, or condition outside the attacker\u0027s control is involved, and heap grooming lets the attacker influence which address the truncated pointer resolves to.\nPR:L - Attaching a struct_ops program needs CAP_BPF, which is delegable to unprivileged container workloads via BPF tokens; and on a system already running a BPF qdisc or struct_ops scheduler, any unprivileged local user\u0027s ordinary network traffic drives the miscompiled callback, so real root in the init namespace is not required.\nUI:N - The corrupted return value is consumed by the kernel\u0027s own packet-transmit path as soon as the attacker sends traffic; no action by any other user is needed.\nS:U - The truncated pointer is dereferenced by kernel code within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The truncated pointer resolves into the mapped kernel-image window and is then treated as a struct sk_buff by sch_direct_xmit(), so kernel image/global memory is read through the confused object and can even be handed to the NIC for transmission \u2014 a type confusion yielding kernel memory disclosure.\nI:H - The packet path writes through the confused pointer (skb list linkage, requeue, stats updates) into whatever writable kernel .data/.bss lands at the sign-extended address, giving a type-confusion write primitive against kernel state.\nA:H - The commit documents a reproducible kernel oops (\"Unable to handle kernel paging request at virtual address ffffffffa38dbf58\" in __qdisc_run) taking down the machine, repeatable by an unprivileged process."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:35.719Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/92751937f12a7d34ad492577a251c94a55e97e72"
        },
        {
          "url": "https://git.kernel.org/stable/c/918a399501e28e0cc36dbd1fcfb4208f8aa1e4d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd2e08128944a7679e753f920e9eda72057e427c"
        }
      ],
      "title": "riscv, bpf: Sign extend struct ops return values properly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40079",
    "datePublished": "2025-10-28T11:48:44.122Z",
    "dateReserved": "2025-04-16T07:20:57.160Z",
    "dateUpdated": "2026-08-05T12:07:35.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40079",
      "date": "2026-09-20",
      "epss": "0.00142",
      "percentile": "0.03889"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-29T01:05:01.000Z",
      "cve": "CVE-2025-40079",
      "id": "msrc_CVE-2025-40079",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "riscv, bpf: Sign extend struct ops return values properly",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40079.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/riscv/net/bpf_jit_comp64.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "92751937f12a7d34ad492577a251c94a55e97e72",
                    "status": "affected",
                    "version": "25ad10658dc1068a671553ff10e19a812c2a3783",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "918a399501e28e0cc36dbd1fcfb4208f8aa1e4d1",
                    "status": "affected",
                    "version": "25ad10658dc1068a671553ff10e19a812c2a3783",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd2e08128944a7679e753f920e9eda72057e427c",
                    "status": "affected",
                    "version": "25ad10658dc1068a671553ff10e19a812c2a3783",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/riscv/net/bpf_jit_comp64.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv, bpf: Sign extend struct ops return values properly\n\nThe ns_bpf_qdisc selftest triggers a kernel panic:\n\n    Unable to handle kernel paging request at virtual address ffffffffa38dbf58\n    Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000\n    [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000\n    Oops [#1]\n    Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]\n    CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G        W  OE       6.17.0-rc1-g2465bb83e0b4 #1 NONE\n    Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n    Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024\n    epc : __qdisc_run+0x82/0x6f0\n     ra : __qdisc_run+0x6e/0x6f0\n    epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550\n     gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180\n     t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0\n     s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001\n     a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000\n     a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049\n     s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000\n     s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0\n     s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000\n     s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000\n     t5 : 0000000000000000 t6 : ff60000093a6a8b6\n    status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d\n    [\u003cffffffff80bd5c7a\u003e] __qdisc_run+0x82/0x6f0\n    [\u003cffffffff80b6fe58\u003e] __dev_queue_xmit+0x4c0/0x1128\n    [\u003cffffffff80b80ae0\u003e] neigh_resolve_output+0xd0/0x170\n    [\u003cffffffff80d2daf6\u003e] ip6_finish_output2+0x226/0x6c8\n    [\u003cffffffff80d31254\u003e] ip6_finish_output+0x10c/0x2a0\n    [\u003cffffffff80d31446\u003e] ip6_output+0x5e/0x178\n    [\u003cffffffff80d2e232\u003e] ip6_xmit+0x29a/0x608\n    [\u003cffffffff80d6f4c6\u003e] inet6_csk_xmit+0xe6/0x140\n    [\u003cffffffff80c985e4\u003e] __tcp_transmit_skb+0x45c/0xaa8\n    [\u003cffffffff80c995fe\u003e] tcp_connect+0x9ce/0xd10\n    [\u003cffffffff80d66524\u003e] tcp_v6_connect+0x4ac/0x5e8\n    [\u003cffffffff80cc19b8\u003e] __inet_stream_connect+0xd8/0x318\n    [\u003cffffffff80cc1c36\u003e] inet_stream_connect+0x3e/0x68\n    [\u003cffffffff80b42b20\u003e] __sys_connect_file+0x50/0x88\n    [\u003cffffffff80b42bee\u003e] __sys_connect+0x96/0xc8\n    [\u003cffffffff80b42c40\u003e] __riscv_sys_connect+0x20/0x30\n    [\u003cffffffff80e5bcae\u003e] do_trap_ecall_u+0x256/0x378\n    [\u003cffffffff80e69af2\u003e] handle_exception+0x14a/0x156\n    Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709\n    ---[ end trace 0000000000000000 ]---\n\nThe bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer\nis treated as a 32bit value and sign extend to 64bit in epilogue. This\nbehavior is right for most bpf prog types but wrong for struct ops which\nrequires RISC-V ABI.\n\nSo let\u0027s sign extend struct ops return values according to the function\nmodel and RISC-V ABI([0]).\n\n  [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf"
          }
        ],
        "id": "CVE-2025-40079",
        "lastModified": "2026-07-30T06:24:09.970",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-28T12:15:42.480",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/918a399501e28e0cc36dbd1fcfb4208f8aa1e4d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/92751937f12a7d34ad492577a251c94a55e97e72"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fd2e08128944a7679e753f920e9eda72057e427c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:34:17+00:00",
      "cve": "CVE-2025-40079",
      "id": "CVE-2025-40079",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: riscv, bpf: Sign extend struct ops return values properly",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40079.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.