BPF Access Vulnerability in Linux Kernel Userspace Networking

CVE-2025-40078

What is CVE-2025-40078?

A vulnerability in the Linux kernel's bpf_sock_addr functionality allows improper access to padded memory. Exploitation can occur when sock_addr programs attempt to interact with kernel structures that have implicit padding. This could lead to significant security issues as the context access conversion may encounter errors, potentially making the system vulnerable to attackers. The issue has been addressed in a patch that enforces explicit checks for all relevant fields within bpf_sock_addr, ensuring that unauthorized accesses do not occur.

References