# CVE-2025-40079: riscv, bpf: Sign extend struct ops return values properly

CVE-2025-40079 is fixed in linux on 1 platform, first by DEBIAN-CVE-2025-40079, released October 28, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-40079
- Priority: High
- CVSS: 7.8 (Moderate)
- EPSS: 0.0015
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 28, 2025
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40079

## Description

In the Linux kernel, the following vulnerability has been resolved:  riscv, bpf: Sign extend struct ops return values properly  The ns_bpf_qdisc selftest triggers a kernel panic:      Unable to handle kernel paging request at virtual address ffffffffa38dbf58     Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000     [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000     Oops [#1]     Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]     CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G        W  OE       6.17.0-rc1-g2465bb83e0b4 #1 NONE     Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE     Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024     epc : __qdisc_run+0x82/0x6f0      ra : __qdisc_run+0x6e/0x6f0     epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550      gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180      t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0      s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001      a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000      a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049      s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000      s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0      s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000      s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000      t5 : 0000000000000000 t6 : ff60000093a6a8b6     status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d     [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0     [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128     [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170     [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8     [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0     [<ffffffff80d31446>] ip6_output+0x5e/0x178     [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608     [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140     [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8     [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10     [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8     [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318     [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68     [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88     [<ffffffff80b42bee>] __sys_connect+0x96/0xc8     [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30     [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378     [<ffffffff80e69af2>] handle_exception+0x14a/0x156     Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709     ---[ end trace 0000000000000000 ]---  The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires RISC-V ABI.  So let's sign extend struct ops return values according to the function model and RISC-V ABI([0]).    [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.57-1 | [DEBIAN-CVE-2025-40079](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40079.md) | Oct 28, 2025 |
| Linux | linux Debian 14 | 6.17.6-1 | [DEBIAN-CVE-2025-40079](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40079.md) | Oct 28, 2025 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.