The Linux kernel vulnerability CVE-2025-40123 concerns the BPF subsystem's handling of expected_attach_type during tailcalls between BPF programs. A fuzzer discovered an uninitialized pointer issue in bpf_prog_test_run_xdp(), causing a NULL pointer dereference when a BPF program dereferences the txq member of an xdp_buff object. The root cause is that tailcalls between BPF programs did not properly enforce expected_attach_type compatibility, allowing programs to bypass restrictions tied to their attach types. The fix enforces expected_attach_type checks in the __bpf_prog_map_compatible() function for tailcall maps, ensuring that tailcalls do not violate attach type constraints. This enforcement does not apply to BPF devmaps or cpumaps, as those invoke programs in a different context. The vulnerability has been resolved in the Linux kernel.

Exploitation of this vulnerability could lead to a NULL pointer dereference in the kernel, causing denial of service (kernel crash). Additionally, improper enforcement of expected_attach_type constraints could allow BPF programs to perform unauthorized operations or access restricted kernel data, potentially leading to privilege escalation or other security breaches. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges, no user interaction, and results in high confidentiality, integrity, and availability impact.

A fix for this vulnerability has been implemented in the Linux kernel by enforcing expected_attach_type checks for tailcall maps in the BPF subsystem. Users and administrators should apply the official Linux kernel updates that include this patch. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended mitigation. Patch status is not explicitly stated in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.