Security readout for executives and security teams
Plain-English summary
A Linux kernel bug on RISC-V can corrupt a pointer returned by a BPF struct_ops program, causing invalid memory access and a kernel panic. The supplied severity is high, but the evidence demonstrates a crash rather than confirmed code execution or real-world attacks.
Executive priority
Prioritize supported RISC-V systems that permit local users or use BPF-based networking. Schedule prompt kernel updates, while treating other architectures as outside the evidence supplied. Escalate immediately if matching kernel crashes appear; current sources do not establish active exploitation.
Technical view
The RISC-V BPF JIT incorrectly handles struct_ops return-value extension. A pointer returned by the documented bpf_fifo_dequeue test is treated as a 32-bit value and sign-extended to 64 bits, producing an invalid address. The referenced stable-kernel commits correct return handling according to the function model and RISC-V ABI.
Likely exposure
Exposure is limited to RISC-V systems running an affected Linux kernel with relevant BPF struct_ops functionality reachable. The bundle lists 6.6, 6.12.53, 6.17.3, and 6.18 among affected version data, but does not clearly define complete ranges. Confirm status with the kernel or distribution vendor.
Exploitation context
The CVSS vector describes a local, low-privileged attack requiring no user interaction. The supplied record is not in KEV and provides no evidence of active exploitation. It documents a reproducible kernel panic during a BPF self-test; confidentiality and integrity impact are scored high but not demonstrated in the description.
Researcher notes
The demonstrated failure occurs when bpf_fifo_dequeue returns an skb pointer that is mishandled by the RISC-V BPF epilogue. The record supplies three stable-tree corrections but lacks clear affected-range semantics, prerequisite analysis, CWE classification, and evidence that exploitation extends beyond denial of service.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced stable-kernel correction.
- Map distribution kernel builds to the upstream fix commits before declaring systems remediated.
- Restrict unnecessary local access while affected RISC-V systems await updates.
- Review vendor guidance before disabling BPF features, because no configuration workaround is documented.
Validation and detection
- Inventory RISC-V hosts and record their exact kernel and distribution build versions.
- Confirm the installed build includes an applicable referenced stable-kernel fix.
- Determine whether BPF struct_ops functionality is enabled or used on affected hosts.
- Review kernel logs for paging faults or panics involving BPF, qdisc, or __qdisc_run.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40079 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/92751937f12a7d34ad492577a251c94a55e97e72CVE reference, Linux
- https://git.kernel.org/stable/c/918a399501e28e0cc36dbd1fcfb4208f8aa1e4d1CVE reference, Linux
- https://git.kernel.org/stable/c/fd2e08128944a7679e753f920e9eda72057e427cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.