CVE-2025-40124 (GCVE-0-2025-40124)

Vulnerability from cvelistv5 – Published: 2025-11-12 10:23 – Updated: 2026-08-05 12:07
VLAI
Title
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
Summary
In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios enabled resulted from copy_from_user() returning impossibly large values greater than the size to be copied. This lead to __copy_from_iter() returning impossible values instead of the actual number of bytes it was able to copy. The BUG_ON has been reported in https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. The exception handlers expect that %o2 has already been masked during the bulk copy loop, but the masking was performed after that loop. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7033 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ee841d0aff649164080e445e84885015958d8ff4 , < fdd43fe6d286f27b826572457a89c926f97e2d3a (git)
Affected: ee841d0aff649164080e445e84885015958d8ff4 , < 1198077606aeffb102587c6ea079ce99641c99d4 (git)
Affected: ee841d0aff649164080e445e84885015958d8ff4 , < 1857cdca12c4aff58bf26a7005a4d02850c29927 (git)
Affected: ee841d0aff649164080e445e84885015958d8ff4 , < 91eda032eb16e5d2be27c95584665bc555bb5a90 (git)
Affected: ee841d0aff649164080e445e84885015958d8ff4 , < dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e (git)
Affected: ee841d0aff649164080e445e84885015958d8ff4 , < 5ef9c94d7110e90260c06868cf1dcf899b9f25ee (git)
Affected: ee841d0aff649164080e445e84885015958d8ff4 , < e50377c6b3f278c9f3ef017ffce17f5fcc9dace4 (git)
Affected: ee841d0aff649164080e445e84885015958d8ff4 , < 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 (git)
Affected: 1c7e17b1c4d60cc5aa575460f7efb73686dd3b39 (git)
Affected: ac663c54f40b2830b1ca32d1ae9d683fe248b14c (git)
Affected: 4.4.34 , < 4.5 (semver)
Affected: 4.8.10 , < 4.9 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.4.301 , ≤ 5.4.* (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.156 , ≤ 6.1.* (semver)
Unaffected: 6.6.112 , ≤ 6.6.* (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/sparc/lib/U3memcpy.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fdd43fe6d286f27b826572457a89c926f97e2d3a",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "1198077606aeffb102587c6ea079ce99641c99d4",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "1857cdca12c4aff58bf26a7005a4d02850c29927",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "91eda032eb16e5d2be27c95584665bc555bb5a90",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "5ef9c94d7110e90260c06868cf1dcf899b9f25ee",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "e50377c6b3f278c9f3ef017ffce17f5fcc9dace4",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "47b49c06eb62504075f0f2e2227aee2e2c2a58b3",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1c7e17b1c4d60cc5aa575460f7efb73686dd3b39",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac663c54f40b2830b1ca32d1ae9d683fe248b14c",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.34",
              "versionType": "semver"
            },
            {
              "lessThan": "4.9",
              "status": "affected",
              "version": "4.8.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/sparc/lib/U3memcpy.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.8.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III\n\nAnthony Yznaga tracked down that a BUG_ON in ext4 code with large folios\nenabled resulted from copy_from_user() returning impossibly large values\ngreater than the size to be copied. This lead to __copy_from_iter()\nreturning impossible values instead of the actual number of bytes it was\nable to copy.\n\nThe BUG_ON has been reported in\nhttps://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de\n\nThe referenced commit introduced exception handlers on user-space memory\nreferences in copy_from_user and copy_to_user. These handlers return from\nthe respective function and calculate the remaining bytes left to copy\nusing the current register contents. The exception handlers expect that\n%o2 has already been masked during the bulk copy loop, but the masking was\nperformed after that loop. This will fix the return value of copy_from_user\nand copy_to_user in the faulting case. The behaviour of memcpy stays\nunchanged."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The fault must occur inside a `copy_{from,to}_user()` on a buffer in the attacker\u0027s own address space, which requires local `mmap`/`munmap`/`mprotect` control plus a local syscall entry (write(2), ioctl(2), etc.). No remote peer can cause a user-copy fault at a chosen offset.\nAC:L - Every precondition is deterministic and attacker-chosen: length \u2265 192 selects the VIS block-copy path, dst/src alignment is controllable, and the fault offset is placed exactly by unmapping or PROT_NONE-ing a page of the source buffer. There is no race and no dependence on unpredictable memory layout.\nPR:L - Any unprivileged local user can trigger this with ordinary `write(2)`/`read(2)`/`ioctl(2)` plus `mmap`/`munmap`; no capability, namespace trick, or privileged device access is required.\nUI:N - The attacking process performs the entire sequence itself \u2014 mapping the partially-valid buffer and issuing the syscall. No victim action is involved.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The over-reported count underflows `iterate_iovec()`/`iterate_ubuf()` accounting, causing the iterator to walk past the end of the kernel iovec array and treat arbitrary kernel memory as iovec descriptors, and the resulting heap corruption primitive can be leveraged for kernel memory disclosure.\nI:H - `_inline_copy_from_user()`\u0027s tail `memset(to + (n - res), 0, res)` with `res \u003e n` wraps the pointer and zeroes up to ~n bytes of kernel heap memory *before* the destination buffer \u2014 an attacker-sized out-of-bounds write (4 KB underflow for a 4 KB copy) into adjacent slab objects, a well-known privilege-escalation primitive.\nA:H - The bug was reported as a hard `BUG_ON` panic in ext4\u0027s large-folio write path, and the `size_t` underflow of `iter-\u003ecount`/`len` also drives runaway iteration loops \u2014 both are full kernel denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:57.197Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fdd43fe6d286f27b826572457a89c926f97e2d3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1198077606aeffb102587c6ea079ce99641c99d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1857cdca12c4aff58bf26a7005a4d02850c29927"
        },
        {
          "url": "https://git.kernel.org/stable/c/91eda032eb16e5d2be27c95584665bc555bb5a90"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ef9c94d7110e90260c06868cf1dcf899b9f25ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/e50377c6b3f278c9f3ef017ffce17f5fcc9dace4"
        },
        {
          "url": "https://git.kernel.org/stable/c/47b49c06eb62504075f0f2e2227aee2e2c2a58b3"
        }
      ],
      "title": "sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40124",
    "datePublished": "2025-11-12T10:23:19.861Z",
    "dateReserved": "2025-04-16T07:20:57.169Z",
    "dateUpdated": "2026-08-05T12:07:57.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40124",
      "date": "2026-10-29",
      "epss": "0.00166",
      "percentile": "0.05809"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/sparc/lib/U3memcpy.S"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fdd43fe6d286f27b826572457a89c926f97e2d3a",
                    "status": "affected",
                    "version": "ee841d0aff649164080e445e84885015958d8ff4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1198077606aeffb102587c6ea079ce99641c99d4",
                    "status": "affected",
                    "version": "ee841d0aff649164080e445e84885015958d8ff4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1857cdca12c4aff58bf26a7005a4d02850c29927",
                    "status": "affected",
                    "version": "ee841d0aff649164080e445e84885015958d8ff4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "91eda032eb16e5d2be27c95584665bc555bb5a90",
                    "status": "affected",
                    "version": "ee841d0aff649164080e445e84885015958d8ff4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e",
                    "status": "affected",
                    "version": "ee841d0aff649164080e445e84885015958d8ff4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5ef9c94d7110e90260c06868cf1dcf899b9f25ee",
                    "status": "affected",
                    "version": "ee841d0aff649164080e445e84885015958d8ff4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e50377c6b3f278c9f3ef017ffce17f5fcc9dace4",
                    "status": "affected",
                    "version": "ee841d0aff649164080e445e84885015958d8ff4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47b49c06eb62504075f0f2e2227aee2e2c2a58b3",
                    "status": "affected",
                    "version": "ee841d0aff649164080e445e84885015958d8ff4",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "1c7e17b1c4d60cc5aa575460f7efb73686dd3b39",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ac663c54f40b2830b1ca32d1ae9d683fe248b14c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.5",
                    "status": "affected",
                    "version": "4.4.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "affected",
                    "version": "4.8.10",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/sparc/lib/U3memcpy.S"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.9"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.301",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.246",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.195",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.156",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III\n\nAnthony Yznaga tracked down that a BUG_ON in ext4 code with large folios\nenabled resulted from copy_from_user() returning impossibly large values\ngreater than the size to be copied. This lead to __copy_from_iter()\nreturning impossible values instead of the actual number of bytes it was\nable to copy.\n\nThe BUG_ON has been reported in\nhttps://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de\n\nThe referenced commit introduced exception handlers on user-space memory\nreferences in copy_from_user and copy_to_user. These handlers return from\nthe respective function and calculate the remaining bytes left to copy\nusing the current register contents. The exception handlers expect that\n%o2 has already been masked during the bulk copy loop, but the masking was\nperformed after that loop. This will fix the return value of copy_from_user\nand copy_to_user in the faulting case. The behaviour of memcpy stays\nunchanged."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsparc: corregir el informe preciso de excepciones en copy_{from_to}_user para UltraSPARC III\n\nAnthony Yznaga descubri\u00f3 que un BUG_ON en el c\u00f3digo ext4 con folios grandes habilitados resultaba de que copy_from_user() devolviera valores imposiblemente grandes, mayores que el tama\u00f1o a copiar. Esto llev\u00f3 a que __copy_from_iter() devolviera valores imposibles en lugar del n\u00famero real de bytes que pudo copiar.\n\nEl BUG_ON ha sido reportado en https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de\n\nEl commit referenciado introdujo manejadores de excepciones en referencias de memoria de espacio de usuario en copy_from_user y copy_to_user. Estos manejadores regresan de la funci\u00f3n respectiva y calculan los bytes restantes por copiar utilizando el contenido actual del registro. Los manejadores de excepciones esperan que %o2 ya haya sido enmascarado durante el bucle de copia masiva, pero el enmascaramiento se realiz\u00f3 despu\u00e9s de ese bucle. Esto corregir\u00e1 el valor de retorno de copy_from_user y copy_to_user en el caso de fallo. El comportamiento de memcpy permanece sin cambios."
          }
        ],
        "id": "CVE-2025-40124",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-11-12T11:15:41.920",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1198077606aeffb102587c6ea079ce99641c99d4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1857cdca12c4aff58bf26a7005a4d02850c29927"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47b49c06eb62504075f0f2e2227aee2e2c2a58b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5ef9c94d7110e90260c06868cf1dcf899b9f25ee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/91eda032eb16e5d2be27c95584665bc555bb5a90"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e50377c6b3f278c9f3ef017ffce17f5fcc9dace4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fdd43fe6d286f27b826572457a89c926f97e2d3a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:15:28+00:00",
      "cve": "CVE-2025-40124",
      "id": "CVE-2025-40124",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40124.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.