GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40123 (GCVE-0-2025-40123)

Vulnerability from cvelistv5 – Published: 2025-11-12 10:23 – Updated: 2026-09-14 11:58
VLAI
Title
bpf: Enforce expected_attach_type for tailcall compatibility
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. This leads to a NULL pointer dereference when a BPF program attempts to deference the txq member of struct xdp_buff object. The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the entry point for bpf_prog_test_run_xdp() and its expected_attach_type can neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP to pass xdp_is_valid_access() validation. The program returns struct xdp_md's egress_ifindex, and the latter is only allowed to be accessed under mentioned expected_attach_type. progB is then inserted into the tailcall which progA calls. The underlying issue goes beyond XDP though. Another example are programs of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well as sock_addr_func_proto() have different logic depending on the programs' expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME should not be allowed doing a tailcall into a program which calls bpf_bind() out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. In short, specifying expected_attach_type allows to open up additional functionality or restrictions beyond what the basic bpf_prog_type enables. The use of tailcalls must not violate these constraints. Fix it by enforcing expected_attach_type in __bpf_prog_map_compatible(). Note that we only enforce this for tailcall maps, but not for BPF devmaps or cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and cpu_map_bpf_prog_run*() which set up a new environment / context and therefore these situations are not prone to this issue.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5e43f899b03a3492ce5fc44e8900becb04dae9c0 , < e53a59e7cee5c1605d1ed595933098c2b69108f9 (git)
Affected: 5e43f899b03a3492ce5fc44e8900becb04dae9c0 , < dc4f348952173beb8ceb15be30b249276eccb605 (git)
Affected: 5e43f899b03a3492ce5fc44e8900becb04dae9c0 , < a99de19128aec0913f3d529f529fbbff5edfaff8 (git)
Affected: 5e43f899b03a3492ce5fc44e8900becb04dae9c0 , < 08cb3dc9d2b44f153d0bcf2cb966e4a94b5d0f32 (git)
Affected: 5e43f899b03a3492ce5fc44e8900becb04dae9c0 , < f856c598080ba7ce1252867b8ecd6ad5bdaf9a6a (git)
Affected: 5e43f899b03a3492ce5fc44e8900becb04dae9c0 , < c1ad19b5d8e23123503dcaf2d4342e1b90b923ad (git)
Affected: 5e43f899b03a3492ce5fc44e8900becb04dae9c0 , < 4540aed51b12bc13364149bf95f6ecef013197c0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.156 , ≤ 6.1.* (semver)
Unaffected: 6.6.112 , ≤ 6.6.* (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e53a59e7cee5c1605d1ed595933098c2b69108f9",
              "status": "affected",
              "version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
              "versionType": "git"
            },
            {
              "lessThan": "dc4f348952173beb8ceb15be30b249276eccb605",
              "status": "affected",
              "version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
              "versionType": "git"
            },
            {
              "lessThan": "a99de19128aec0913f3d529f529fbbff5edfaff8",
              "status": "affected",
              "version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
              "versionType": "git"
            },
            {
              "lessThan": "08cb3dc9d2b44f153d0bcf2cb966e4a94b5d0f32",
              "status": "affected",
              "version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
              "versionType": "git"
            },
            {
              "lessThan": "f856c598080ba7ce1252867b8ecd6ad5bdaf9a6a",
              "status": "affected",
              "version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
              "versionType": "git"
            },
            {
              "lessThan": "c1ad19b5d8e23123503dcaf2d4342e1b90b923ad",
              "status": "affected",
              "version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
              "versionType": "git"
            },
            {
              "lessThan": "4540aed51b12bc13364149bf95f6ecef013197c0",
              "status": "affected",
              "version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Enforce expected_attach_type for tailcall compatibility\n\nYinhao et al. recently reported:\n\n  Our fuzzer tool discovered an uninitialized pointer issue in the\n  bpf_prog_test_run_xdp() function within the Linux kernel\u0027s BPF subsystem.\n  This leads to a NULL pointer dereference when a BPF program attempts to\n  deference the txq member of struct xdp_buff object.\n\nThe test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the\nentry point for bpf_prog_test_run_xdp() and its expected_attach_type can\nneither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot\nof a tailcall map it owns. progB\u0027s expected_attach_type must be BPF_XDP_DEVMAP\nto pass xdp_is_valid_access() validation. The program returns struct xdp_md\u0027s\negress_ifindex, and the latter is only allowed to be accessed under mentioned\nexpected_attach_type. progB is then inserted into the tailcall which progA\ncalls.\n\nThe underlying issue goes beyond XDP though. Another example are programs\nof type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well\nas sock_addr_func_proto() have different logic depending on the programs\u0027\nexpected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME\nshould not be allowed doing a tailcall into a program which calls bpf_bind()\nout of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.\n\nIn short, specifying expected_attach_type allows to open up additional\nfunctionality or restrictions beyond what the basic bpf_prog_type enables.\nThe use of tailcalls must not violate these constraints. Fix it by enforcing\nexpected_attach_type in __bpf_prog_map_compatible().\n\nNote that we only enforce this for tailcall maps, but not for BPF devmaps or\ncpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and\ncpu_map_bpf_prog_run*() which set up a new environment / context and therefore\nthese situations are not prone to this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the bpf(2) syscall \u2014 loading two programs with differing expected_attach_type, populating a BPF_MAP_TYPE_PROG_ARRAY, and invoking the tail call via BPF_PROG_TEST_RUN or a live attach. No network-supplied data introduces the incompatible tail call, so local access is required.\nAC:L - Exploitation is fully deterministic: the attacker authors and loads both programs, owns the prog array, and controls exactly when the tail call executes; there is no race and no memory-layout condition needed for the mis-typed context dereference to occur.\nPR:L - A basic local user with BPF program-loading access can create the prog array and the two mismatched programs; this matches the established scoring of comparable BPF verifier-constraint bypasses, and containerized/delegated-token deployments grant exactly this level without full administrative rights.\nUI:N - The attacker performs every step \u2014 program load, map update, and program invocation \u2014 entirely on their own; no victim action or cooperation is involved.\nS:U - The mis-typed context dereference and any resulting corruption occur within the kernel that is already the vulnerable component, so impact stays inside a single security authority.\nC:H - xdp_init_buff() never initializes xdp_buff-\u003etxq, so a tail-called BPF_XDP_DEVMAP program reading egress_ifindex dereferences attacker-groomable uninitialized stack memory twice and returns the resulting kernel dword into BPF, which can be exfiltrated through a map \u2014 an effectively arbitrary kernel read primitive.\nI:H - Bypassing expected_attach_type lets a program execute helpers and context writes the running hook never validated \u2014 e.g. bpf_bind()/__inet_bind() invoked from a GETPEERNAME hook mutates live socket binding and hash state without the socket lock, and msg_src_ip4/6 or sockopt level/optname/retval writes land on NULL or wrong-type kernel fields.\nA:H - The reported case is an immediate NULL pointer dereference on xdp_buff-\u003etxq in bpf_prog_test_run_xdp(), and in driver XDP paths the uninitialized txq produces a wild pointer dereference \u2014 either way a kernel oops that the attacker can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:08.635Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e53a59e7cee5c1605d1ed595933098c2b69108f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc4f348952173beb8ceb15be30b249276eccb605"
        },
        {
          "url": "https://git.kernel.org/stable/c/a99de19128aec0913f3d529f529fbbff5edfaff8"
        },
        {
          "url": "https://git.kernel.org/stable/c/08cb3dc9d2b44f153d0bcf2cb966e4a94b5d0f32"
        },
        {
          "url": "https://git.kernel.org/stable/c/f856c598080ba7ce1252867b8ecd6ad5bdaf9a6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1ad19b5d8e23123503dcaf2d4342e1b90b923ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/4540aed51b12bc13364149bf95f6ecef013197c0"
        }
      ],
      "title": "bpf: Enforce expected_attach_type for tailcall compatibility",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40123",
    "datePublished": "2025-11-12T10:23:19.589Z",
    "dateReserved": "2025-04-16T07:20:57.169Z",
    "dateUpdated": "2026-09-14T11:58:08.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40123",
      "date": "2026-09-16",
      "epss": "0.00155",
      "percentile": "0.05"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40123\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-12T11:15:41.807\",\"lastModified\":\"2026-09-14T12:17:37.453\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Enforce expected_attach_type for tailcall compatibility\\n\\nYinhao et al. recently reported:\\n\\n  Our fuzzer tool discovered an uninitialized pointer issue in the\\n  bpf_prog_test_run_xdp() function within the Linux kernel\u0027s BPF subsystem.\\n  This leads to a NULL pointer dereference when a BPF program attempts to\\n  deference the txq member of struct xdp_buff object.\\n\\nThe test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the\\nentry point for bpf_prog_test_run_xdp() and its expected_attach_type can\\nneither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot\\nof a tailcall map it owns. progB\u0027s expected_attach_type must be BPF_XDP_DEVMAP\\nto pass xdp_is_valid_access() validation. The program returns struct xdp_md\u0027s\\negress_ifindex, and the latter is only allowed to be accessed under mentioned\\nexpected_attach_type. progB is then inserted into the tailcall which progA\\ncalls.\\n\\nThe underlying issue goes beyond XDP though. Another example are programs\\nof type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well\\nas sock_addr_func_proto() have different logic depending on the programs\u0027\\nexpected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME\\nshould not be allowed doing a tailcall into a program which calls bpf_bind()\\nout of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.\\n\\nIn short, specifying expected_attach_type allows to open up additional\\nfunctionality or restrictions beyond what the basic bpf_prog_type enables.\\nThe use of tailcalls must not violate these constraints. Fix it by enforcing\\nexpected_attach_type in __bpf_prog_map_compatible().\\n\\nNote that we only enforce this for tailcall maps, but not for BPF devmaps or\\ncpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and\\ncpu_map_bpf_prog_run*() which set up a new environment / context and therefore\\nthese situations are not prone to this issue.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/bpf.h\",\"kernel/bpf/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5e43f899b03a3492ce5fc44e8900becb04dae9c0\",\"lessThan\":\"e53a59e7cee5c1605d1ed595933098c2b69108f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e43f899b03a3492ce5fc44e8900becb04dae9c0\",\"lessThan\":\"dc4f348952173beb8ceb15be30b249276eccb605\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e43f899b03a3492ce5fc44e8900becb04dae9c0\",\"lessThan\":\"a99de19128aec0913f3d529f529fbbff5edfaff8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e43f899b03a3492ce5fc44e8900becb04dae9c0\",\"lessThan\":\"08cb3dc9d2b44f153d0bcf2cb966e4a94b5d0f32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e43f899b03a3492ce5fc44e8900becb04dae9c0\",\"lessThan\":\"f856c598080ba7ce1252867b8ecd6ad5bdaf9a6a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e43f899b03a3492ce5fc44e8900becb04dae9c0\",\"lessThan\":\"c1ad19b5d8e23123503dcaf2d4342e1b90b923ad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e43f899b03a3492ce5fc44e8900becb04dae9c0\",\"lessThan\":\"4540aed51b12bc13364149bf95f6ecef013197c0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/bpf.h\",\"kernel/bpf/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.156\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.112\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.53\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.3\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08cb3dc9d2b44f153d0bcf2cb966e4a94b5d0f32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4540aed51b12bc13364149bf95f6ecef013197c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a99de19128aec0913f3d529f529fbbff5edfaff8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c1ad19b5d8e23123503dcaf2d4342e1b90b923ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc4f348952173beb8ceb15be30b249276eccb605\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e53a59e7cee5c1605d1ed595933098c2b69108f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f856c598080ba7ce1252867b8ecd6ad5bdaf9a6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:08:14+00:00",
      "cve": "CVE-2025-40123",
      "id": "CVE-2025-40123",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Enforce expected_attach_type for tailcall compatibility",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40123.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T02:19:20Z",
      "cve": "CVE-2025-40123",
      "id": "CVE-2025-40123",
      "initial_release_date": "2025-11-13T00:24:22Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "716",
      "product_status:known_not_affected": "96",
      "product_status:recommended": "312",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40123",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40123.json",
      "version": "39"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.