Linux kernel BPF verifier: get_helper_proto dereferences a NULL helper function pointer when a config option is disabled

Impact

Helper function pointers can be NULL when the config option backing them is not enabled, and get_helper_proto() did not check before use, so loading a program that references such a helper takes the verifier through a NULL pointer. The fix adds the check and marks the unused tail_call helper with BPF_PTR_POISON. This was found by the kernel test robot, and the exposure depends on the kernel build: only configurations that compile out a helper's backing feature are affected, which is why many distribution kernels will not reach it. Where it is reachable, the consequence is a kernel oops at program-load time - a node-wide availability event on a GPU host whose BPF load path is also used by the CNI and by observability agents, with no data-disclosure claim in the record.

Who can reach it

Local. Requires the ability to load a BPF program - CAP_BPF or CAP_SYS_ADMIN, so a privileged container or a node agent rather than an ordinary unprivileged tenant - on a kernel built with the relevant helper's config option disabled.

What to do

Pick up the stable kernel carrying the get_helper_proto validity check (three backports linked) at the next kernel maintenance; drain and reboot per node. Check whether your kernel build actually disables the affected helper config before prioritising. Restricting CAP_BPF to trusted node agents is the standing mitigation and already keeps most tenants out of this path.

References

Related entries

• Linux kernel hugetlbfs: fallocate hole-punch races page migration and corrupts page accountingCVE-2025-40006 · Linux kernel hugetlbfs (remove_inode_single_folio folio-lock race)High
• Linux kernel (net/smc): SMC-D loopback registers DMBs (the direct memory buffers a peer reads and writes) out ofCVE-2025-40012 · Linux kernel (net/smc)High
• Linux kernel vhost: missing task reference lets vhost_task_wake() touch a freed task_structCVE-2025-40024 · Linux kernel vhost (struct vhost_task task_struct reference counting)High
• Linux kernel io_uring: waitid entry left on the wait queue races the callback on cancellationCVE-2025-40047 · Linux kernel io_uring waitid (io_waitid_wait wait-queue entry pruning)High
• Linux kernel vhost vringh: copy helper return values checked for negative instead of short copiesCVE-2025-40051 · Linux kernel vhost vringh (copy_from_iter/copy_to_iter return value check)High
• Linux kernel (net/smc): Connect() on an SMC socket takes the destination device pointer out of the dst cache without aCVE-2025-40064 · Linux kernel (net/smc)High