Linux kernel BPF verifier: signed comparison accepts negative ALU instruction offsets

Impact

The verifier's check that an ALU instruction's 16-bit off field is 0 (or 1 for BPF_DIV/BPF_MOD) used a signed > comparison, so every negative offset passed validation. A malformed program carrying a negative offset reaches the JIT and interpreter with a value no code path expects, which is a verifier-escape class bug: the whole safety argument for loading unprivileged or capability-scoped BPF rests on the verifier rejecting it. NVD scores this local privilege escalation (confidentiality, integrity and availability all High). On a GPU node this matters wherever BPF loading is reachable from workloads - CAP_BPF or CAP_SYS_ADMIN containers, eBPF-based CNIs and observability agents, and sidecars that tenants control - because a kernel compromise on a shared GPU host hands over every co-tenant's device state and training data.

Who can reach it

Local, authenticated: a user or container that can call bpf(BPF_PROG_LOAD). That means unprivileged BPF where it is enabled, or any pod granted CAP_BPF/CAP_SYS_ADMIN. Not reachable from the network and not reachable by a tenant with no BPF access.

What to do

Pick up the stable kernel containing the fix (condition tightened to insn->off != 0 && insn->off != 1) and reboot each node; a kernel bump on a GPU host means draining the node, so batch it with other pending kernel CVEs rather than opening a window for this alone. Until then, the exposure is removed by keeping kernel.unprivileged_bpf_disabled=1 and not granting CAP_BPF or CAP_SYS_ADMIN to tenant pods. No vendor-assigned fixed release is listed in the record beyond the stable commits.

References

Related entries

• Linux kernel x86/mm: missing SMP barrier in switch_mm lets a context switch skip a required TLB flushCVE-2025-40174 · Linux kernel x86/mm switch_mm_irqs_off() (missing barrier between loaded_mm store and tlb_gen load)High
• Linux kernel crypto: skcipher request size left uninitialized, causing memory corruption and crashesCVE-2025-40182 · Linux kernel crypto skcipher (request size set from cra_reqsize)High
• Linux kernel io_uring: registered-buffer folio offset miscalculated for unaligned user pointersCVE-2025-40216 · Linux kernel io_uring/rsrc (registered buffer folio coalescing)High
• Linux kernel (virt/kvm): Unbinding a memslot from a guest_memfd was skipped once the file was already dying, so if theCVE-2025-40274 · Linux kernel (virt/kvm)High
• Linux kernel (drivers/gpu/drm/vmwgfx): The vmwgfx command-buffer parser trusted a size field taken straight from theCVE-2025-40277 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• VMware Aria Operations / VMware Tools: Local privilege escalation to root inside a managed VM via SDMP service discoveryCVE-2025-41244 · VMware Aria Operations / VMware ToolsHigh