UBUNTU-CVE-2025-40143
In the Linux kernel, the following vulnerability has been resolved: bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Syzbot generated a program that triggers a verifier_bug() call in maybe_exit_scc(). maybe_exit_scc() assumes that, when called for a state with insn_idx in some SCC, there should be an instance of struct bpf_scc_visit allocated for that SCC. Turns out the assumption does not hold for speculative execution paths. See example in the next patch. maybe_scc_exit() is called from update_branch_counts() for states that reach branch count of zero, meaning that path exploration for a particular path is finished. Path exploration can finish in one of three ways: a. Verification error is found. In this case, update_branch_counts() is called only for non-speculative paths. b. Top level BPF_EXIT is reached. Such instructions are never a part of an SCC, so compute_scc_callchain() in maybe_scc_exit() will return false, and maybe_scc_exit() will return early. c. A checkpoint is reached and matched. Checkpoints are created by is_state_visited(), which calls maybe_enter_scc(), which allocates bpf_scc_visit instances for checkpoints within SCCs. Hence, for non-speculative symbolic execution paths, the assumption still holds: if maybe_scc_exit() is called for a state within an SCC, bpf_scc_visit instance must exist. This patch removes the verifier_bug() call for speculative paths.
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
6 explicit affected versions
24 explicit affected versions
10 explicit affected versions
26 explicit affected versions
7 explicit affected versions
13 explicit affected versions
35 explicit affected versions
18 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
12 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
14 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
12 explicit affected versions
1 explicit affected versions
12 explicit affected versions
9 explicit affected versions
10 explicit affected versions
37 explicit affected versions
1 explicit affected versions
13 explicit affected versions
10 explicit affected versions
26 explicit affected versions
13 explicit affected versions
29 explicit affected versions
13 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
11 explicit affected versions
12 explicit affected versions
1 explicit affected versions
7 explicit affected versions
12 explicit affected versions
8 explicit affected versions
10 explicit affected versions
26 explicit affected versions
1 explicit affected versions
13 explicit affected versions
16 explicit affected versions
3 explicit affected versions
7 explicit affected versions
7 explicit affected versions
51 explicit affected versions
8 explicit affected versions
18 explicit affected versions
12 explicit affected versions
1 explicit affected versions
27 explicit affected versions
8 explicit affected versions
5 explicit affected versions
8 explicit affected versions
10 explicit affected versions
7 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
10 explicit affected versions
12 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
45 explicit affected versions
37 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
9 explicit affected versions
11 explicit affected versions
6 explicit affected versions
7 explicit affected versions
4 explicit affected versions
1 explicit affected versions
13 explicit affected versions
43 explicit affected versions
6 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
6 explicit affected versions
11 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Syzbot generated a program that triggers a verifier_bug() call in maybe_exit_scc(). maybe_exit_scc() assumes that, when called for a state with insn_idx in some SCC, there should be an instance of struct bpf_scc_visit allocated for that SCC. Turns out the assumption does not hold for speculative execution paths. See example in the next patch. maybe_scc_exit() is called from update_branch_counts() for states that reach branch count of zero, meaning that path exploration for a particular path is finished. Path exploration can finish in one of three ways: a. Verification error is found. In this case, update_branch_counts() is called only for non-speculative paths. b. Top level BPF_EXIT is reached. Such instructions are never a part of an SCC, so compute_scc_callchain() in maybe_scc_exit() will return false, and maybe_scc_exit() will return early. c. A checkpoint is reached and matched. Checkpoints are created by is_state_visited(), which calls maybe_enter_scc(), which allocates bpf_scc_visit instances for checkpoints within SCCs. Hence, for non-speculative symbolic execution paths, the assumption still holds: if maybe_scc_exit() is called for a state within an SCC, bpf_scc_visit instance must exist. This patch removes the verifier_bug() call for speculative paths.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/a3c73d629ea1373af3c0c954d41fd1af555492e3
- https://git.kernel.org/stable/c/3861e7c4324aa20a632fb74eb3904114f6afdb57
- https://git.kernel.org/stable/c/a3c73d629ea1373af3c0c954d41fd1af555492e3
- https://ubuntu.com/security/CVE-2025-40143
- https://ubuntu.com/security/notices/USN-8029-1
- https://ubuntu.com/security/notices/USN-8029-2
- https://ubuntu.com/security/notices/USN-8029-3
- https://ubuntu.com/security/notices/USN-8030-1
- https://ubuntu.com/security/notices/USN-8048-1
- https://www.cve.org/CVERecord?id=CVE-2025-40143