Security readout for executives and security teams
Plain-English summary
This is an architecture-specific Linux kernel flaw affecting LoongArch systems. Incorrect handling of a BPF struct-operations return value can turn a valid pointer into an invalid address and crash the kernel. The supplied CVSS score is 7.8 (high), although the source demonstrates a panic rather than a real-world compromise.
Executive priority
Treat this as a targeted high-priority kernel update for LoongArch infrastructure, not an estate-wide emergency without LoongArch exposure. Accelerate remediation where affected systems run untrusted local workloads or rely heavily on BPF. Confirm distribution-specific fixes because the bundle does not provide complete package mappings.
Technical view
The LoongArch BPF JIT treated a struct_ops program’s pointer return as a 32-bit value and sign-extended it to 64 bits. That behavior conflicts with the LoongArch ABI and the function model’s return specification, producing an invalid skb pointer. The ns_bpf_qdisc selftest triggered a kernel paging fault in __qdisc_run.
Likely exposure
Exposure is limited to LoongArch systems running versions identified as affected in the bundle: Linux 6.17, 6.17.3, and 6.18. Relevant BPF struct_ops use is also required for the documented failure. The supplied version data is insufficient to map every distribution kernel or backport conclusively.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. However, the provided evidence only demonstrates a kernel panic during a BPF selftest. The CVE is not in KEV, and no source supplied here reports active exploitation.
Researcher notes
The demonstrated root cause is incorrect return-value extension in the LoongArch BPF struct_ops path. Two stable-kernel commits are cited as resolution references. Public evidence supplied here does not establish exploitation, privilege escalation, or data compromise beyond the CVSS assessment; the reproducible result is a kernel paging fault and panic.
Mitigation direction
- Inventory LoongArch hosts and record exact Linux kernel releases and vendor builds.
- Determine whether each build includes either cited stable-kernel fix commit.
- Apply vendor-supported kernel updates containing the appropriate stable fix.
- Prioritize systems where local users or workloads can exercise BPF struct operations.
Validation and detection
- Confirm the host CPU architecture is LoongArch before classifying it as exposed.
- Compare kernel version and patch provenance with the affected entries and cited commits.
- After updating, confirm the intended fixed kernel is running.
- In non-production, rerun the relevant BPF selftest and verify that no kernel panic occurs.
- Review logs for paging faults or panics involving __qdisc_run and bpf_testmod.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40041 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9f3169bb3c2967166b4f4433cf152a84f3eb95d0CVE reference, Linux
- https://git.kernel.org/stable/c/8b51b11b3d81c1ed48a52f87da9256d737b723a0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.