CVE-2025-40143

The Linux kernel's BPF verifier contained a flaw in maybe_exit_scc(), a function that manages state when path exploration finishes for a strongly connected component (SCC). The function assumed that a struct bpf_scc_visit instance would always be allocated for any SCC state being examined. However, this assumption failed for speculative execution paths, leading to a verifier_bug() call that triggers a kernel panic or warning, effectively a denial-of-service condition.

The vulnerability is triggered when the verifier explores a speculative path (e.g., due to a branch misprediction) and a state reaches a branch count of zero. In such cases, maybe_scc_exit() is invoked, but the corresponding bpf_scc_visit may not have been allocated because maybe_enter_scc() only allocates it for checkpoints on non-speculative paths. Attackers with the ability to load crafted BPF programs (requiring CAP_BPF or root privileges) could exploit this to crash the system.

A successful exploit causes the verifier to call verifier_bug(), which typically results in a kernel BUG or warning, leading to a system crash or hang. No privilege escalation or data leak is implied by the available sources; the primary impact is denial of service.

The fix, included in Linux kernel stable tree commit [1], removes the verifier_bug() call for speculative paths, allowing the verifier to handle the missing bpf_scc_visit gracefully instead of panicking. Users should apply the latest stable kernel updates to mitigate this issue.