{"cve":"CVE-2025-40143","nvd":{"published":"2025-11-12T11:15:44.130","modified":"2026-10-19T21:10:00.160","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: dont report verifier bug for missing bpf_scc_visit on speculative path\n\nSyzbot generated a program that triggers a verifier_bug() call in\nmaybe_exit_scc(). maybe_exit_scc() assumes that, when called for a\nstate with insn_idx in some SCC, there should be an instance of struct\nbpf_scc_visit allocated for that SCC. Turns out the assumption does\nnot hold for speculative execution paths. See example in the next\npatch.\n\nmaybe_scc_exit() is called from update_branch_counts() for states that\nreach branch count of zero, meaning that path exploration for a\nparticular path is finished. Path exploration can finish in one of\nthree ways:\na. Verification error is found. In this case, update_branch_counts()\n   is called only for non-speculative paths.\nb. Top level BPF_EXIT is reached. Such instructions are never a part of\n   an SCC, so compute_scc_callchain() in maybe_scc_exit() will return\n   false, and maybe_scc_exit() will return early.\nc. A checkpoint is reached and matched. Checkpoints are created by\n   is_state_visited(), which calls maybe_enter_scc(), which allocates\n   bpf_scc_visit instances for checkpoints within SCCs.\n\nHence, for non-speculative symbolic execution paths, the assumption\nstill holds: if maybe_scc_exit() is called for a state within an SCC,\nbpf_scc_visit instance must exist.\n\nThis patch removes the verifier_bug() call for speculative paths.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/3861e7c4324aa20a632fb74eb3904114f6afdb57","https://git.kernel.org/stable/c/a3c73d629ea1373af3c0c954d41fd1af555492e3"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2025-40143","score":0.00264,"percentile":0.18138,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}