Not yet scoredPublished Oct 28, 2025

CVE-2025-40078bpf: Explicitly check accesses to bpf_sock_addr

Updated under an hour ago (Oct 27, 2026, 6:50 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access. This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access. I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1cedee13d25ab118d325f95588c1a084e9317229 before de44cdc50d2dce8718cb57deddf9cf1be9a7759f; from 1cedee13d25ab118d325f95588c1a084e9317229 before 76e04bbb4296fb6eac084dbfc27e02ccc744db3e; from 1cedee13d25ab118d325f95588c1a084e9317229 before 6d8b1a21fd5c34622b0c3893c61e4a38d8ba53ec; from 1cedee13d25ab118d325f95588c1a084e9317229 before 4f00858cd9bbbdf67159e28b85a8ca9e77c83622; from 1cedee13d25ab118d325f95588c1a084e9317229 before cdeafacb4f9ff261a96baef519e29480fd7b1019; from 1cedee13d25ab118d325f95588c1a084e9317229 before fe9d33f0470350558cb08cecb54cf2267b3a45d2; from 1cedee13d25ab118d325f95588c1a084e9317229 before ad8b4fe5617e3c85fc23267f02500c4f3bf0ff69; from 1cedee13d25ab118d325f95588c1a084e9317229 before 6fabca2fc94d33cdf7ec102058983b086293395f	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP

References

References

https://git.kernel.org/stable/c/de44cdc50d2dce8718cb57deddf9cf1be9a7759f
https://git.kernel.org/stable/c/76e04bbb4296fb6eac084dbfc27e02ccc744db3e
https://git.kernel.org/stable/c/6d8b1a21fd5c34622b0c3893c61e4a38d8ba53ec
https://git.kernel.org/stable/c/4f00858cd9bbbdf67159e28b85a8ca9e77c83622
https://git.kernel.org/stable/c/cdeafacb4f9ff261a96baef519e29480fd7b1019
https://git.kernel.org/stable/c/fe9d33f0470350558cb08cecb54cf2267b3a45d2
https://git.kernel.org/stable/c/ad8b4fe5617e3c85fc23267f02500c4f3bf0ff69
https://git.kernel.org/stable/c/6fabca2fc94d33cdf7ec102058983b086293395f
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.