PT-2025-44109 · Linux · Linux Kernel

Published 2025-10-28 · Updated 2025-10-28 · CVE-2025-40041

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.16.0+ and later

Description The Linux kernel contains a flaw in the BPF subsystem related to handling struct operations on the LoongArch architecture. Specifically, the return values of struct operations are not correctly sign-extended, leading to a potential kernel panic. The issue was identified during testing with the ns bpf qdisc selftest. The incorrect sign extension occurs because the return value, treated as a 32-bit value, is improperly extended to 64-bit, which is incorrect for the LoongArch ABI. This can cause issues when dealing with struct operations that require the LoongArch ABI.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-40041

Affected Products

Linux Kernel

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-40041 · Security Note
• https://twitter.com/CVEnew/status/1983149477964959840 · Twitter Post
• https://git.kernel.org/stable/c/8b51b11b3d81c1ed48a52f87da9256d737b723a0 · Note
• https://git.kernel.org/stable/c/9f3169bb3c2967166b4f4433cf152a84f3eb95d0 · Note