CVE-2025-40123

Vulnerability

The vulnerability resides in the Linux kernel's BPF subsystem, specifically in how tailcall maps handle program compatibility. The __bpf_prog_map_compatible() function does not verify the expected_attach_type of BPF programs when inserting them into a tailcall map. This allows a program with one expected_attach_type to tailcall into another program with a different expected_attach_type, bypassing the type-specific access controls. The issue was initially discovered through a NULL pointer dereference in bpf_prog_test_run_xdp() when a program with an incompatible attach type accessed txq member of xdp_buff.

Exploitation

An attacker with the ability to load BPF programs and create tailcall maps can exploit this flaw. For example, two XDP programs progA and progB can be crafted: progA as an entry point with a generic XDP attach type, and progB with BPF_XDP_DEVMAP attach type (which allows accessing egress_ifindex). progA then tailcalls into progB from its own tailcall map. Due to the missing check, progB executes with the context of the original entry program, potentially dereferencing invalid pointers. The same principle applies to other program types like CGROUP_SOCK_ADDR, where a program attached to BPF_CGROUP_INET4_GETPEERNAME could tailcall into one that uses bpf_bind(), which is only allowed for BPF_CGROUP_INET4_CONNECT.

Impact

Successful exploitation can lead to a denial of service (system crash due to NULL pointer dereference) or, in more severe cases, privilege escalation. By bypassing the expected_attach_type constraints, an attacker may gain access to sensitive kernel operations or data structures that should be restricted to specific attach types. The vulnerability does not require physical access but does require the ability to load and attach BPF programs, which typically needs root or CAP_BPF.

Mitigation

The kernel developers have addressed the issue by enforcing expected_attach_type checks in __bpf_prog_map_compatible() for tailcall maps. The fix is included in the Linux kernel stable tree. Users should apply the latest stable kernel updates to mitigate the vulnerability. The fix does not apply to devmaps or cpumaps, as those programs operate in a different context and are not susceptible to this issue.