{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T12:59:58.884Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69e043bce09c9a77e5f55b9ac7505874a2a1a9f0",
              "status": "affected",
              "version": "3354822cde5a9f72aa725b3c619188b149a71a33",
              "versionType": "git"
            },
            {
              "lessThan": "6ebd02cf2dde11b86f89ea4c9f55179eab30d4ee",
              "status": "affected",
              "version": "3354822cde5a9f72aa725b3c619188b149a71a33",
              "versionType": "git"
            },
            {
              "lessThan": "4d6b4bea8b80bfa13c903ba547538249e7c5e977",
              "status": "affected",
              "version": "3354822cde5a9f72aa725b3c619188b149a71a33",
              "versionType": "git"
            },
            {
              "lessThan": "d47515af6cccd7484d8b0870376858c9848a18ec",
              "status": "affected",
              "version": "3354822cde5a9f72aa725b3c619188b149a71a33",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Clean up only new IRQ glue on request_irq() failure\n\nThe mlx5_irq_alloc() function can inadvertently free the entire rmap\nand end up in a crash[1] when the other threads tries to access this,\nwhen request_irq() fails due to exhausted IRQ vectors. This commit\nmodifies the cleanup to remove only the specific IRQ mapping that was\njust added.\n\nThis prevents removal of other valid mappings and ensures precise\ncleanup of the failed IRQ allocation\u0027s associated glue object.\n\nNote: This error is observed when both fwctl and rds configs are enabled.\n\n[1]\nmlx5_core 0000:05:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:06:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\ngeneral protection fault, probably for non-canonical address\n0xe277a58fde16f291: 0000 [#1] SMP NOPTI\n\nRIP: 0010:free_irq_cpu_rmap+0x23/0x7d\nCall Trace:\n   \u003cTASK\u003e\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   ? __die_body.cold+0x8/0xa\n   ? die_addr+0x39/0x53\n   ? exc_general_protection+0x1c4/0x3e9\n   ? dev_vprintk_emit+0x5f/0x90\n   ? asm_exc_general_protection+0x22/0x27\n   ? free_irq_cpu_rmap+0x23/0x7d\n   mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   irq_pool_request_vector+0x7d/0x90 [mlx5_core]\n   mlx5_irq_request+0x2e/0xe0 [mlx5_core]\n   mlx5_irq_request_vector+0xad/0xf7 [mlx5_core]\n   comp_irq_request_pci+0x64/0xf0 [mlx5_core]\n   create_comp_eq+0x71/0x385 [mlx5_core]\n   ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core]\n   mlx5_comp_eqn_get+0x72/0x90 [mlx5_core]\n   ? xas_load+0x8/0x91\n   mlx5_comp_irqn_get+0x40/0x90 [mlx5_core]\n   mlx5e_open_channel+0x7d/0x3c7 [mlx5_core]\n   mlx5e_open_channels+0xad/0x250 [mlx5_core]\n   mlx5e_open_locked+0x3e/0x110 [mlx5_core]\n   mlx5e_open+0x23/0x70 [mlx5_core]\n   __dev_open+0xf1/0x1a5\n   __dev_change_flags+0x1e1/0x249\n   dev_change_flags+0x21/0x5c\n   do_setlink+0x28b/0xcc4\n   ? __nla_parse+0x22/0x3d\n   ? inet6_validate_link_af+0x6b/0x108\n   ? cpumask_next+0x1f/0x35\n   ? __snmp6_fill_stats64.constprop.0+0x66/0x107\n   ? __nla_validate_parse+0x48/0x1e6\n   __rtnl_newlink+0x5ff/0xa57\n   ? kmem_cache_alloc_trace+0x164/0x2ce\n   rtnl_newlink+0x44/0x6e\n   rtnetlink_rcv_msg+0x2bb/0x362\n   ? __netlink_sendskb+0x4c/0x6c\n   ? netlink_unicast+0x28f/0x2ce\n   ? rtnl_calcit.isra.0+0x150/0x146\n   netlink_rcv_skb+0x5f/0x112\n   netlink_unicast+0x213/0x2ce\n   netlink_sendmsg+0x24f/0x4d9\n   __sock_sendmsg+0x65/0x6a\n   ____sys_sendmsg+0x28f/0x2c9\n   ? import_iovec+0x17/0x2b\n   ___sys_sendmsg+0x97/0xe0\n   __sys_sendmsg+0x81/0xd8\n   do_syscall_64+0x35/0x87\n   entry_SYSCALL_64_after_hwframe+0x6e/0x0\nRIP: 0033:0x7fc328603727\nCode: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed\nff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 00\nf0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48\nRSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727\nRDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d\nRBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\nR13: 00000000000\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered only from local interfaces \u2014 rtnetlink/ethtool link-up (`mlx5e_open` \u2192 `create_comp_eq`) or the RDMA uverbs `CREATE_CQ` ioctl supplying `comp_vector` \u2014 not from processing received packets. The dangling `netdev-\u003erx_cpu_rmap` is later consumed in the RX softirq, but the attacker\u0027s trigger for the free is purely local.\nAC:L - The attacker drives the triggering condition themselves by repeatedly allocating completion vectors (CQ per comp_vector across mlx5 uverbs devices, or channel/link-up cycles) until MSI-X/x86 vector space is exhausted and `request_irq()` returns -ENOSPC; the very next allocation attempt deterministically executes the buggy cleanup. `CONFIG_RFS_ACCEL` is `default y`, so no rare config is needed, and the dangling `eq_table-\u003ermap`/`rx_cpu_rmap` pointers persist afterwards with no race to win.\nPR:L - `mlx5_comp_eqn_get()` is reachable from `ib_uverbs_create_cq` with a user-chosen `comp_vector` and requires no capability beyond an open handle on `/dev/infiniband/uverbs*`, which rdma-core udev rules commonly expose mode 0666 on exactly the RDMA/HPC hosts that carry mlx5 hardware. An unprivileged local user can therefore force the dynamic IRQ allocations and the `request_irq()` failure.\nUI:N - No victim action is required; the attacker\u0027s own syscalls allocate the completion queues and trigger the failing IRQ request, and the resulting stale pointer is consumed by kernel teardown and RX steering without any user involvement.\nS:U - The premature free and all subsequent corruption occur within the kernel\u0027s own slab and driver state; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free of the `struct cpu_rmap` \u2014 `free_irq_cpu_rmap()` and `cpu_rmap_lookup_obj()` read `rmap-\u003eobj[]`/`rmap-\u003enear[]` out of a freed, sprayable kmalloc object, and `set_rps_cpu()` uses the freed `rx_cpu_rmap` index to address `dev-\u003e_rx` out of bounds, giving an attacker who reclaims the slot a kernel-memory read primitive.\nI:H - After the free, `irq_cpu_rmap_add()` performs `kref_get()` and `rmap-\u003eobj[index] = glue` into the reallocated object, and `free_irq_cpu_rmap()` runs `irq_set_affinity_notifier()`/`kref_put()` on a fully attacker-controlled `glue` pointer read from freed memory \u2014 refcount manipulation, controlled pointer write, and a double-free path suitable for control-flow hijack.\nA:H - The reported failure is a general protection fault in `free_irq_cpu_rmap+0x23` ending in \"Kernel panic - not syncing: Fatal exception\", and any thread touching the stale `eq_table-\u003ermap` or `netdev-\u003erx_cpu_rmap` can crash the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:52.687Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69e043bce09c9a77e5f55b9ac7505874a2a1a9f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ebd02cf2dde11b86f89ea4c9f55179eab30d4ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d6b4bea8b80bfa13c903ba547538249e7c5e977"
        },
        {
          "url": "https://git.kernel.org/stable/c/d47515af6cccd7484d8b0870376858c9848a18ec"
        }
      ],
      "title": "net/mlx5: Clean up only new IRQ glue on request_irq() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40250",
    "datePublished": "2025-12-04T16:08:12.984Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:52.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40250",
      "date": "2026-08-12",
      "epss": "0.00154",
      "percentile": "0.05048"
    },
    "microsoft_vex": {
      "current_release_date": "2026-01-07T14:37:02.000Z",
      "cve": "CVE-2025-40250",
      "id": "msrc_CVE-2025-40250",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/mlx5: Clean up only new IRQ glue on request_irq() failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40250.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40250\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-04T16:16:18.527\",\"lastModified\":\"2026-07-30T06:24:22.217\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Clean up only new IRQ glue on request_irq() failure\\n\\nThe mlx5_irq_alloc() function can inadvertently free the entire rmap\\nand end up in a crash[1] when the other threads tries to access this,\\nwhen request_irq() fails due to exhausted IRQ vectors. This commit\\nmodifies the cleanup to remove only the specific IRQ mapping that was\\njust added.\\n\\nThis prevents removal of other valid mappings and ensures precise\\ncleanup of the failed IRQ allocation\u0027s associated glue object.\\n\\nNote: This error is observed when both fwctl and rds configs are enabled.\\n\\n[1]\\nmlx5_core 0000:05:00.0: Successfully registered panic handler for port 1\\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\\nrequest irq. err = -28\\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\\ntrying to test write-combining support\\nmlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1\\nmlx5_core 0000:06:00.0: Successfully registered panic handler for port 1\\nmlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\\nrequest irq. err = -28\\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\\ntrying to test write-combining support\\nmlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1\\nmlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\\nrequest irq. err = -28\\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\\nrequest irq. err = -28\\ngeneral protection fault, probably for non-canonical address\\n0xe277a58fde16f291: 0000 [#1] SMP NOPTI\\n\\nRIP: 0010:free_irq_cpu_rmap+0x23/0x7d\\nCall Trace:\\n   \u003cTASK\u003e\\n   ? show_trace_log_lvl+0x1d6/0x2f9\\n   ? show_trace_log_lvl+0x1d6/0x2f9\\n   ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\\n   ? __die_body.cold+0x8/0xa\\n   ? die_addr+0x39/0x53\\n   ? exc_general_protection+0x1c4/0x3e9\\n   ? dev_vprintk_emit+0x5f/0x90\\n   ? asm_exc_general_protection+0x22/0x27\\n   ? free_irq_cpu_rmap+0x23/0x7d\\n   mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\\n   irq_pool_request_vector+0x7d/0x90 [mlx5_core]\\n   mlx5_irq_request+0x2e/0xe0 [mlx5_core]\\n   mlx5_irq_request_vector+0xad/0xf7 [mlx5_core]\\n   comp_irq_request_pci+0x64/0xf0 [mlx5_core]\\n   create_comp_eq+0x71/0x385 [mlx5_core]\\n   ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core]\\n   mlx5_comp_eqn_get+0x72/0x90 [mlx5_core]\\n   ? xas_load+0x8/0x91\\n   mlx5_comp_irqn_get+0x40/0x90 [mlx5_core]\\n   mlx5e_open_channel+0x7d/0x3c7 [mlx5_core]\\n   mlx5e_open_channels+0xad/0x250 [mlx5_core]\\n   mlx5e_open_locked+0x3e/0x110 [mlx5_core]\\n   mlx5e_open+0x23/0x70 [mlx5_core]\\n   __dev_open+0xf1/0x1a5\\n   __dev_change_flags+0x1e1/0x249\\n   dev_change_flags+0x21/0x5c\\n   do_setlink+0x28b/0xcc4\\n   ? __nla_parse+0x22/0x3d\\n   ? inet6_validate_link_af+0x6b/0x108\\n   ? cpumask_next+0x1f/0x35\\n   ? __snmp6_fill_stats64.constprop.0+0x66/0x107\\n   ? __nla_validate_parse+0x48/0x1e6\\n   __rtnl_newlink+0x5ff/0xa57\\n   ? kmem_cache_alloc_trace+0x164/0x2ce\\n   rtnl_newlink+0x44/0x6e\\n   rtnetlink_rcv_msg+0x2bb/0x362\\n   ? __netlink_sendskb+0x4c/0x6c\\n   ? netlink_unicast+0x28f/0x2ce\\n   ? rtnl_calcit.isra.0+0x150/0x146\\n   netlink_rcv_skb+0x5f/0x112\\n   netlink_unicast+0x213/0x2ce\\n   netlink_sendmsg+0x24f/0x4d9\\n   __sock_sendmsg+0x65/0x6a\\n   ____sys_sendmsg+0x28f/0x2c9\\n   ? import_iovec+0x17/0x2b\\n   ___sys_sendmsg+0x97/0xe0\\n   __sys_sendmsg+0x81/0xd8\\n   do_syscall_64+0x35/0x87\\n   entry_SYSCALL_64_after_hwframe+0x6e/0x0\\nRIP: 0033:0x7fc328603727\\nCode: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed\\nff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 00\\nf0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48\\nRSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\\nRAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727\\nRDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d\\nRBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000\\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\\nR13: 00000000000\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3354822cde5a9f72aa725b3c619188b149a71a33\",\"lessThan\":\"69e043bce09c9a77e5f55b9ac7505874a2a1a9f0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3354822cde5a9f72aa725b3c619188b149a71a33\",\"lessThan\":\"6ebd02cf2dde11b86f89ea4c9f55179eab30d4ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3354822cde5a9f72aa725b3c619188b149a71a33\",\"lessThan\":\"4d6b4bea8b80bfa13c903ba547538249e7c5e977\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3354822cde5a9f72aa725b3c619188b149a71a33\",\"lessThan\":\"d47515af6cccd7484d8b0870376858c9848a18ec\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.118\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.60\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.10\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4d6b4bea8b80bfa13c903ba547538249e7c5e977\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/69e043bce09c9a77e5f55b9ac7505874a2a1a9f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6ebd02cf2dde11b86f89ea4c9f55179eab30d4ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d47515af6cccd7484d8b0870376858c9848a18ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:39:14+00:00",
      "cve": "CVE-2025-40250",
      "id": "CVE-2025-40250",
      "initial_release_date": "2025-12-04T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: Clean up only new IRQ glue on request_irq() failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40250.json",
      "version": "3"
    }
  }
}