Search: CVE-2025-40123

A vulnerability in the Linux kernel's BPF subsystem involving tailcall compatibility and enforcement of expected_attach_type has been resolved. The issue arises from an uninitialized pointer in the bpf_prog_test_run_xdp() function, leading to a NULL pointer dereference when accessing the txq member of the xdp_buff structure. The flaw involves improper enforcement of expected_attach_type constraints during tailcalls between BPF programs, potentially allowing invalid access patterns. The fix enforces expected_attach_type checks in __bpf_prog_map_compatible() for tailcall maps to prevent violations. This vulnerability affects the kernel's BPF subsystem and related program types that rely on expected_attach_type for access control.