Security readout for executives and security teams
Plain-English summary
A Linux kernel BPF verifier validation flaw allows malformed arithmetic instructions with negative offsets to pass a check intended to permit only zero or one. The CVSS score is 7.8 because a low-privileged local attacker could potentially affect confidentiality, integrity, and availability. The supplied evidence does not establish a specific exploitation outcome.
Executive priority
Treat this as a high-priority kernel update for exposed multi-user Linux systems, while avoiding emergency claims unsupported by exploitation evidence. Schedule prompt remediation through normal kernel maintenance, prioritizing systems permitting low-privileged BPF use. Broader urgency depends on vendor applicability and local BPF access controls.
Technical view
The signed 16-bit BPF instruction offset was checked only for values greater than one, unintentionally accepting negative values. The upstream correction explicitly accepts only zero, plus one for BPF_MOD and BPF_DIV. This hardens check_alu_op() against malformed BPF programs; the source bundle does not document a demonstrated verifier bypass or resulting primitive.
Likely exposure
Exposure is limited to affected Linux kernels where a low-privileged local actor can submit BPF programs. The supplied affected-version data names Linux 6.6, 6.6.112, 6.12.53, 6.17.3, and 6.18, but its exact range semantics are unclear. Confirm applicability with the relevant distribution or kernel vendor.
Exploitation context
The CVSS vector describes local access, low attack complexity, low privileges, and no user interaction. CVE-2025-40169 is not identified as CISA KEV in the supplied bundle, and no cited source establishes active exploitation, public weaponization, or a proven impact chain.
Researcher notes
The validation defect and correction are clearly described, but the supplied evidence does not show how negative ALU offsets produce memory corruption, privilege escalation, or another concrete primitive. Four stable commits are referenced without branch mapping here. The version list includes an unexplained zero and duplicated commit identifiers, so vendor-specific applicability requires confirmation.
Mitigation direction
- Apply a vendor-supported Linux kernel containing the applicable upstream stable fix.
- Consult the Linux distribution or appliance vendor for corrected package versions and rollout guidance.
- Ensure systems boot into the corrected kernel after completing the vendor-prescribed update process.
- Prioritize multi-user or shared systems where low-privileged users can submit BPF programs.
Validation and detection
- Inventory running kernel versions, not only installed kernel packages.
- Compare each kernel build against the CVE record and relevant distribution advisory.
- Confirm the running build contains the applicable upstream stable fix commit.
- Review local BPF access controls when assessing practical exposure.
- Retest kernel version and security controls after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40169 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3bce44b344040e5eef3d64d38b157c15304c0aabCVE reference, Linux
- https://git.kernel.org/stable/c/5017c302ca4b2a45149ad64e058fa2d5623c068fCVE reference, Linux
- https://git.kernel.org/stable/c/21167bf70dbe400563e189ac632258d35eda38b5CVE reference, Linux
- https://git.kernel.org/stable/c/55c0ced59fe17dee34e9dfd5f7be63cbab207758CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.