ghsa-fv7m-5jq2-37ch
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
bpf: dont report verifier bug for missing bpf_scc_visit on speculative path
Syzbot generated a program that triggers a verifier_bug() call in maybe_exit_scc(). maybe_exit_scc() assumes that, when called for a state with insn_idx in some SCC, there should be an instance of struct bpf_scc_visit allocated for that SCC. Turns out the assumption does not hold for speculative execution paths. See example in the next patch.
maybe_scc_exit() is called from update_branch_counts() for states that reach branch count of zero, meaning that path exploration for a particular path is finished. Path exploration can finish in one of three ways: a. Verification error is found. In this case, update_branch_counts() is called only for non-speculative paths. b. Top level BPF_EXIT is reached. Such instructions are never a part of an SCC, so compute_scc_callchain() in maybe_scc_exit() will return false, and maybe_scc_exit() will return early. c. A checkpoint is reached and matched. Checkpoints are created by is_state_visited(), which calls maybe_enter_scc(), which allocates bpf_scc_visit instances for checkpoints within SCCs.
Hence, for non-speculative symbolic execution paths, the assumption still holds: if maybe_scc_exit() is called for a state within an SCC, bpf_scc_visit instance must exist.
This patch removes the verifier_bug() call for speculative paths.
{
"affected": [],
"aliases": [
"CVE-2025-40143"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-12T11:15:44Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: dont report verifier bug for missing bpf_scc_visit on speculative path\n\nSyzbot generated a program that triggers a verifier_bug() call in\nmaybe_exit_scc(). maybe_exit_scc() assumes that, when called for a\nstate with insn_idx in some SCC, there should be an instance of struct\nbpf_scc_visit allocated for that SCC. Turns out the assumption does\nnot hold for speculative execution paths. See example in the next\npatch.\n\nmaybe_scc_exit() is called from update_branch_counts() for states that\nreach branch count of zero, meaning that path exploration for a\nparticular path is finished. Path exploration can finish in one of\nthree ways:\na. Verification error is found. In this case, update_branch_counts()\n is called only for non-speculative paths.\nb. Top level BPF_EXIT is reached. Such instructions are never a part of\n an SCC, so compute_scc_callchain() in maybe_scc_exit() will return\n false, and maybe_scc_exit() will return early.\nc. A checkpoint is reached and matched. Checkpoints are created by\n is_state_visited(), which calls maybe_enter_scc(), which allocates\n bpf_scc_visit instances for checkpoints within SCCs.\n\nHence, for non-speculative symbolic execution paths, the assumption\nstill holds: if maybe_scc_exit() is called for a state within an SCC,\nbpf_scc_visit instance must exist.\n\nThis patch removes the verifier_bug() call for speculative paths.",
"id": "GHSA-fv7m-5jq2-37ch",
"modified": "2025-11-12T12:30:27Z",
"published": "2025-11-12T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40143"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3861e7c4324aa20a632fb74eb3904114f6afdb57"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a3c73d629ea1373af3c0c954d41fd1af555492e3"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.