{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/mdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc56548fca732f3d3692c83b40db796259a03887",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bf1683078fbdd09a7f7f9b74121ebaa03432bd00",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2a112cdd66f5a132da5235ca31a320528c86bf33",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e148ed5cda8fd96d4620c4622fb02f552a2d166a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cfafefcb0e1fc60135f7040f4aed0a4aef4f76ca",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3b447fd401824e1ccf0b769188edefe866a1e676",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "502fa92a71f344611101bd04ef1a595b8b6014f5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/mdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.196",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.115",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.56",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()\n\nThe syzbot reported issue in hfs_find_set_zero_bits():\n\n=====================================================\nBUG: KMSAN: uninit-value in hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45\n hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45\n hfs_vbm_search_free+0x13c/0x5b0 fs/hfs/bitmap.c:151\n hfs_extend_file+0x6a5/0x1b00 fs/hfs/extent.c:408\n hfs_get_block+0x435/0x1150 fs/hfs/extent.c:353\n __block_write_begin_int+0xa76/0x3030 fs/buffer.c:2151\n block_write_begin fs/buffer.c:2262 [inline]\n cont_write_begin+0x10e1/0x1bc0 fs/buffer.c:2601\n hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52\n cont_expand_zero fs/buffer.c:2528 [inline]\n cont_write_begin+0x35a/0x1bc0 fs/buffer.c:2591\n hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52\n hfs_file_truncate+0x1d6/0xe60 fs/hfs/extent.c:494\n hfs_inode_setattr+0x964/0xaa0 fs/hfs/inode.c:654\n notify_change+0x1993/0x1aa0 fs/attr.c:552\n do_truncate+0x28f/0x310 fs/open.c:68\n do_ftruncate+0x698/0x730 fs/open.c:195\n do_sys_ftruncate fs/open.c:210 [inline]\n __do_sys_ftruncate fs/open.c:215 [inline]\n __se_sys_ftruncate fs/open.c:213 [inline]\n __x64_sys_ftruncate+0x11b/0x250 fs/open.c:213\n x64_sys_call+0xfe3/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:78\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4154 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x7f7/0xed0 mm/slub.c:4354\n kmalloc_noprof include/linux/slab.h:905 [inline]\n hfs_mdb_get+0x1cc8/0x2a90 fs/hfs/mdb.c:175\n hfs_fill_super+0x3d0/0xb80 fs/hfs/super.c:337\n get_tree_bdev_flags+0x6e3/0x920 fs/super.c:1681\n get_tree_bdev+0x38/0x50 fs/super.c:1704\n hfs_get_tree+0x35/0x40 fs/hfs/super.c:388\n vfs_get_tree+0xb0/0x5c0 fs/super.c:1804\n do_new_mount+0x738/0x1610 fs/namespace.c:3902\n path_mount+0x6db/0x1e90 fs/namespace.c:4226\n do_mount fs/namespace.c:4239 [inline]\n __do_sys_mount fs/namespace.c:4450 [inline]\n __se_sys_mount+0x6eb/0x7d0 fs/namespace.c:4427\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:4427\n x64_sys_call+0xfa7/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:166\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 1 UID: 0 PID: 12609 Comm: syz.1.2692 Not tainted 6.16.0-syzkaller #0 PREEMPT(none)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\n=====================================================\n\nThe HFS_SB(sb)-\u003ebitmap buffer is allocated in hfs_mdb_get():\n\nHFS_SB(sb)-\u003ebitmap = kmalloc(8192, GFP_KERNEL);\n\nFinally, it can trigger the reported issue because kmalloc()\ndoesn\u0027t clear the allocated memory. If allocated memory contains\nonly zeros, then everything will work pretty fine.\nBut if the allocated memory contains the \"garbage\", then\nit can affect the bitmap operations and it triggers\nthe reported issue.\n\nThis patch simply exchanges the kmalloc() on kzalloc()\nwith the goal to guarantee the correctness of bitmap operations.\nBecause, newly created allocation bitmap should have all\navailable blocks free. Potentially, initialization bitmap\u0027s read\noperation could not fill the whole allocated memory and\n\"garbage\" in the not initialized memory will be the reason of\nvolume coruptions and file system driver bugs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only by mounting an HFS block device or image locally and then issuing ordinary file syscalls (ftruncate/write) against it, as in the syzbot trace via `__x64_sys_ftruncate`. There is no network, adjacent-network, or remote-peer data path into `hfs_mdb_get()` or `hfs_find_set_zero_bits()`; local mounting of attacker-supplied media is routine via udisks2/automount, loop devices, and fstab `user` entries.\nAC:L - `kmalloc(8192)` never zeroes and the disk read only covers `(fs_ablocks + 8) / 8` bytes, so on every mount the tail of the bitmap object is stale slab data \u2014 the vulnerable state exists unconditionally, with no race and no memory-layout luck. Every remaining precondition is attacker-authored on-disk metadata (`drNmAlBlks`, `drClpSiz`, extent `block`/`count` feeding `goal`), the residual slab contents are groomable with standard heap-spray techniques, and the syzbot reproducer triggers it reliably.\nPR:L - hfs is registered `FS_REQUIRES_DEV` without `FS_USERNS_MOUNT`, so the mount step needs `CAP_SYS_ADMIN` in the initial namespace and is not obtainable via `unshare -Ur`; however, once a privileged automounter such as udisks2 has mounted the removable volume, an ordinary unprivileged local user drives the entire `hfs_inode_setattr \u2192 hfs_file_truncate \u2192 hfs_get_block \u2192 hfs_extend_file \u2192 hfs_vbm_search_free` path with a plain `ftruncate()`/`write()`, with no capability check anywhere along it.\nUI:N - In the removable-media/udisks2 automount scenario the crafted HFS volume is mounted without any deliberate victim action, and the trigger itself is a normal file truncate or write performed by the attacker on their own image. No action by another user or administrator is required.\nS:U - The uninitialized-memory consumption, the out-of-bounds slab access at the tail of the bitmap object, and any resulting fault all occur inside the host kernel\u0027s own security authority. No VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Stale kmalloc\u0027d slab contents \u2014 potentially remnants of any prior 8 KiB kernel allocation \u2014 are consumed directly as volume allocation state and steer which blocks are handed out; the resulting run lengths and extents are persisted into on-disk metadata the attacker can read back, forming an oracle for leaked heap bytes. Because `goal` from on-disk extents is unvalidated against `fs_ablocks`, the search can also produce extents pointing past the end of the volume, causing `hfs_get_block`/`map_bh` to read device sectors outside the filesystem, and the tail write-back reads a `__be32` past the end of the kmalloc-8k object.\nI:H - The garbage bits drive `hfs_find_set_zero_bits()` to mark uninitialized regions \"used\" and return `*num_bits` exceeding the volume, underflowing `HFS_SB(sb)-\u003efree_ablocks -= *num_bits` (u32) to a huge value and installing extent records that extend past the volume end, which subsequent writes then commit to sectors outside the filesystem \u2014 exactly the \"volume corruptions\" the fix author cites. At the 64 K-bit boundary the `*curr = cpu_to_be32(n)` store at `done:` performs a 4-byte out-of-bounds read-modify-write on the slab object adjacent to the 8192-byte bitmap allocation, which per the OOB-write guidance is High.\nA:H - Consuming uninitialized memory as filesystem allocation state yields the reported KMSAN uninit-value bug plus a slab out-of-bounds access that trips KASAN/panics on hardened kernels, corrupted `free_ablocks` accounting, and extents referencing sectors beyond the volume that drive the block layer into repeated I/O failure. A persistent crafted volume retriggers the condition on every file-extension operation, at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:47.346Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc56548fca732f3d3692c83b40db796259a03887"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf1683078fbdd09a7f7f9b74121ebaa03432bd00"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a112cdd66f5a132da5235ca31a320528c86bf33"
        },
        {
          "url": "https://git.kernel.org/stable/c/e148ed5cda8fd96d4620c4622fb02f552a2d166a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfafefcb0e1fc60135f7040f4aed0a4aef4f76ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b447fd401824e1ccf0b769188edefe866a1e676"
        },
        {
          "url": "https://git.kernel.org/stable/c/502fa92a71f344611101bd04ef1a595b8b6014f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd"
        }
      ],
      "title": "hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40243",
    "datePublished": "2025-12-04T15:31:32.422Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:47.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/bfind.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c1ec90bed504640a42bb20a5f413be39cd17ad71",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b8a72692aa42b7dcd179a96b90bc2763ac74576a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c135b8dca65526aa5b8814e9954e0ae317d9c598",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d7e313039a8f3a6ee072dc5ff4643234d2d735cf",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a5bfb13b4f406aef1a450f99d22d3e48df01528c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "99202d94909d323a30d154ab0261c0a07166daec",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "14c673a2f3ecf650b694a52a88688f1d71849899",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4840ceadef4290c56cc422f0fc697655f3cbf070",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/bfind.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.196",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.115",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.56",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()\n\nThe syzbot reported issue in __hfsplus_ext_cache_extent():\n\n[   70.194323][ T9350] BUG: KMSAN: uninit-value in __hfsplus_ext_cache_extent+0x7d0/0x990\n[   70.195022][ T9350]  __hfsplus_ext_cache_extent+0x7d0/0x990\n[   70.195530][ T9350]  hfsplus_file_extend+0x74f/0x1cf0\n[   70.195998][ T9350]  hfsplus_get_block+0xe16/0x17b0\n[   70.196458][ T9350]  __block_write_begin_int+0x962/0x2ce0\n[   70.196959][ T9350]  cont_write_begin+0x1000/0x1950\n[   70.197416][ T9350]  hfsplus_write_begin+0x85/0x130\n[   70.197873][ T9350]  generic_perform_write+0x3e8/0x1060\n[   70.198374][ T9350]  __generic_file_write_iter+0x215/0x460\n[   70.198892][ T9350]  generic_file_write_iter+0x109/0x5e0\n[   70.199393][ T9350]  vfs_write+0xb0f/0x14e0\n[   70.199771][ T9350]  ksys_write+0x23e/0x490\n[   70.200149][ T9350]  __x64_sys_write+0x97/0xf0\n[   70.200570][ T9350]  x64_sys_call+0x3015/0x3cf0\n[   70.201065][ T9350]  do_syscall_64+0xd9/0x1d0\n[   70.201506][ T9350]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.202054][ T9350]\n[   70.202279][ T9350] Uninit was created at:\n[   70.202693][ T9350]  __kmalloc_noprof+0x621/0xf80\n[   70.203149][ T9350]  hfsplus_find_init+0x8d/0x1d0\n[   70.203602][ T9350]  hfsplus_file_extend+0x6ca/0x1cf0\n[   70.204087][ T9350]  hfsplus_get_block+0xe16/0x17b0\n[   70.204561][ T9350]  __block_write_begin_int+0x962/0x2ce0\n[   70.205074][ T9350]  cont_write_begin+0x1000/0x1950\n[   70.205547][ T9350]  hfsplus_write_begin+0x85/0x130\n[   70.206017][ T9350]  generic_perform_write+0x3e8/0x1060\n[   70.206519][ T9350]  __generic_file_write_iter+0x215/0x460\n[   70.207042][ T9350]  generic_file_write_iter+0x109/0x5e0\n[   70.207552][ T9350]  vfs_write+0xb0f/0x14e0\n[   70.207961][ T9350]  ksys_write+0x23e/0x490\n[   70.208375][ T9350]  __x64_sys_write+0x97/0xf0\n[   70.208810][ T9350]  x64_sys_call+0x3015/0x3cf0\n[   70.209255][ T9350]  do_syscall_64+0xd9/0x1d0\n[   70.209680][ T9350]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.210230][ T9350]\n[   70.210454][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Not tainted 6.12.0-rc5 #5\n[   70.211174][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   70.212115][ T9350] =====================================================\n[   70.212734][ T9350] Disabling lock debugging due to kernel taint\n[   70.213284][ T9350] Kernel panic - not syncing: kmsan.panic set ...\n[   70.213858][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Tainted: G    B              6.12.0-rc5 #5\n[   70.214679][ T9350] Tainted: [B]=BAD_PAGE\n[   70.215057][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   70.215999][ T9350] Call Trace:\n[   70.216309][ T9350]  \u003cTASK\u003e\n[   70.216585][ T9350]  dump_stack_lvl+0x1fd/0x2b0\n[   70.217025][ T9350]  dump_stack+0x1e/0x30\n[   70.217421][ T9350]  panic+0x502/0xca0\n[   70.217803][ T9350]  ? kmsan_get_metadata+0x13e/0x1c0\n\n[   70.218294][ Message fromT sy9350]  kmsan_report+0x296/slogd@syzkaller 0x2aat Aug 18 22:11:058 ...\n kernel\n:[   70.213284][ T9350] Kernel panic - not syncing: kmsan.panic [   70.220179][ T9350]  ? kmsan_get_metadata+0x13e/0x1c0\nset ...\n[   70.221254][ T9350]  ? __msan_warning+0x96/0x120\n[   70.222066][ T9350]  ? __hfsplus_ext_cache_extent+0x7d0/0x990\n[   70.223023][ T9350]  ? hfsplus_file_extend+0x74f/0x1cf0\n[   70.224120][ T9350]  ? hfsplus_get_block+0xe16/0x17b0\n[   70.224946][ T9350]  ? __block_write_begin_int+0x962/0x2ce0\n[   70.225756][ T9350]  ? cont_write_begin+0x1000/0x1950\n[   70.226337][ T9350]  ? hfsplus_write_begin+0x85/0x130\n[   70.226852][ T9350]  ? generic_perform_write+0x3e8/0x1060\n[   70.227405][ T9350]  ? __generic_file_write_iter+0x215/0x460\n[   70.227979][ T9350]  ? generic_file_write_iter+0x109/0x5e0\n[   70.228540][ T9350]  ? vfs_write+0xb0f/0x14e0\n[   70.228997][ T9350]  ? ksys_write+0x23e/0x490\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is only reachable by mounting an attacker-authored HFS+ block device or image locally and then issuing ordinary file syscalls (read/write/unlink) against it; there is no network, adjacent-network, or remote-peer data path into hfsplus_get_block() or hfs_brec_find(). Local mounting of attacker-supplied images is routinely available via udisks2/automount, loop devices, and fstab `user` entries.\nAC:L - Every precondition comes from attacker-authored on-disk metadata: setting vhdr-\u003enext_cnid to 0 deterministically yields inode-\u003ei_ino == 0 so the cnid comparison matches, and an extents b-tree header with root == 0 (or an index node with a zero record offset) deterministically forces the uninitialized-field return path; the residual uninitialized slab/stack values are groomable from userspace with standard techniques and the syzbot reproducer triggers the bug reliably with no race or uncontrollable condition.\nPR:L - hfsplus is registered FS_REQUIRES_DEV without FS_USERNS_MOUNT, so the mount itself needs CAP_SYS_ADMIN in the initial namespace and is not obtainable via unshare -Ur; however, once a privileged automounter such as udisks2 has mounted the removable volume, an ordinary unprivileged local user drives the entire hfsplus_get_block \u2192 hfsplus_file_extend \u2192 __hfsplus_ext_read_extent path with a plain write(), with no capability check anywhere along it.\nUI:N - In the removable-media/udisks2 automount scenario the crafted volume is mounted without any deliberate victim action, and the trigger itself is a normal file read or write performed by the attacker on their own image.\nS:U - The uninitialized-memory consumption, the resulting out-of-bounds page accesses, and any fault all occur inside the host kernel\u0027s own security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The uninitialized fd-\u003erecord and fd-\u003eentryoffset gate and then feed hfs_bnode_read(bnode, \u0026data, off, 4) in the hfs_brec_find() index-node loop, where the unvalidated offset indexes node-\u003epage[] out of bounds and dereferences arbitrary slab contents as a struct page *, giving an unbounded kernel-memory read; in addition, stale kmalloc\u0027d bytes from fd-\u003ekey seed hip-\u003ecached_start/cached_extents, which are persisted into on-disk metadata the attacker reads back.\nI:H - On the hfsplus_free_fork() path, __hfsplus_ext_read_extent() can return success with uninitialized fields, after which hfs_brec_remove() performs hfs_bnode_write_u16() and hfs_bnode_move() using the garbage fd-\u003erecord, fd-\u003ekeyoffset and fd-\u003ekeylength+fd-\u003eentrylength, producing out-of-bounds writes into kernel page data; garbage extent records additionally steer map_bh() to arbitrary device sectors.\nA:H - On the tree-\u003eroot == 0 path fd-\u003ebnode is NULL, so once the uninitialized entrylength passes the \"!= sizeof(hfsplus_extent_rec)\" check the code dereferences a NULL bnode in hfs_bnode_read(); the reported syzbot outcome is already \"Kernel panic - not syncing\", and a persistent crafted volume retriggers the fault on every access."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:48.412Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c1ec90bed504640a42bb20a5f413be39cd17ad71"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8a72692aa42b7dcd179a96b90bc2763ac74576a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c135b8dca65526aa5b8814e9954e0ae317d9c598"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7e313039a8f3a6ee072dc5ff4643234d2d735cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5bfb13b4f406aef1a450f99d22d3e48df01528c"
        },
        {
          "url": "https://git.kernel.org/stable/c/99202d94909d323a30d154ab0261c0a07166daec"
        },
        {
          "url": "https://git.kernel.org/stable/c/14c673a2f3ecf650b694a52a88688f1d71849899"
        },
        {
          "url": "https://git.kernel.org/stable/c/4840ceadef4290c56cc422f0fc697655f3cbf070"
        }
      ],
      "title": "hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40244",
    "datePublished": "2025-12-04T15:31:33.249Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:48.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/nios2/kernel/setup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25f09699edd360b534ccae16bc276c3b52c471f3",
              "status": "affected",
              "version": "7f7bc20bc41a4fbcd2db75b375ac95e5faf958ae",
              "versionType": "git"
            },
            {
              "lessThan": "5c3e38a367822f036227dd52bac82dc4a05157e2",
              "status": "affected",
              "version": "7f7bc20bc41a4fbcd2db75b375ac95e5faf958ae",
              "versionType": "git"
            },
            {
              "lessThan": "b1ec9faef7e36269ca3ec890972a78effbaeb975",
              "status": "affected",
              "version": "7f7bc20bc41a4fbcd2db75b375ac95e5faf958ae",
              "versionType": "git"
            },
            {
              "lessThan": "90f5f715550e07cd6a51f80fc3f062d832c8c997",
              "status": "affected",
              "version": "7f7bc20bc41a4fbcd2db75b375ac95e5faf958ae",
              "versionType": "git"
            },
            {
              "lessThan": "8912814f14e298b83df072fecc1f7ed1b63b1b2c",
              "status": "affected",
              "version": "7f7bc20bc41a4fbcd2db75b375ac95e5faf958ae",
              "versionType": "git"
            },
            {
              "lessThan": "a20b83cf45be2057f3d073506779e52c7fa17f94",
              "status": "affected",
              "version": "7f7bc20bc41a4fbcd2db75b375ac95e5faf958ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/nios2/kernel/setup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.196",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.115",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.56",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnios2: ensure that memblock.current_limit is set when setting pfn limits\n\nOn nios2, with CONFIG_FLATMEM set, the kernel relies on\nmemblock_get_current_limit() to determine the limits of mem_map, in\nparticular for max_low_pfn.\nUnfortunately, memblock.current_limit is only default initialized to\nMEMBLOCK_ALLOC_ANYWHERE at this point of the bootup, potentially leading\nto situations where max_low_pfn can erroneously exceed the value of\nmax_pfn and, thus, the valid range of available DRAM.\n\nThis can in turn cause kernel-level paging failures, e.g.:\n\n[   76.900000] Unable to handle kernel paging request at virtual address 20303000\n[   76.900000] ea = c0080890, ra = c000462c, cause = 14\n[   76.900000] Kernel panic - not syncing: Oops\n[   76.900000] ---[ end Kernel panic - not syncing: Oops ]---\n\nThis patch fixes this by pre-calculating memblock.current_limit\nbased on the upper limits of the available memory ranges via\nadjust_lowmem_bounds, a simplified version of the equivalent\nimplementation within the arm architecture."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in nios2 `setup_arch()` boot-time memory initialization, and its consequences are realized through local activity \u2014 memory allocation and `mmap()`/page-fault paths that call `pfn_valid()`/`pfn_to_page()`. There is no network or remote-peer path to arch/nios2/kernel/setup.c.\nAC:L - `memblock.current_limit` is never set before `find_limits()`, so `max_low_pfn`/`max_mapnr` are unconditionally inflated to ~4 GB of PFNs on every affected nios2 system \u2014 the vulnerable state always exists, with no race and no memory-layout luck required. The attacker only needs to map or touch a physical region above DRAM, which is under their control on these FPGA SoCs where peripheral/on-chip-memory windows sit above RAM.\nPR:L - No capability check guards any of it \u2014 an ordinary unprivileged process reaching `update_mmu_cache_range()`/`flush_dcache_page()` through a fault on a device or PFNMAP mapping, or simply driving allocation into the bogus PFN range, is sufficient. Embedded nios2 deployments routinely expose UIO/framebuffer device nodes to non-root users.\nUI:N - The attacker performs every step themselves \u2014 map the region, touch it, let the fault path run. No action by another user or administrator is needed.\nS:U - The out-of-bounds accesses stay within the kernel\u0027s own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `pfn_valid()` wrongly approves PFNs with no memmap entry, so `pfn_to_page()` returns a pointer up to tens of megabytes past the end of `mem_map`, and `folio_flush_mapping()`/`flush_aliases()` read and follow that out-of-bounds kernel data as an `address_space`. This is a wide, PFN-indexed out-of-bounds read, far beyond a strictly bounded few bytes.\nI:H - `update_mmu_cache_range()` performs `test_and_set_bit(PG_dcache_clean, \u0026folio-\u003eflags.f)` on the out-of-bounds `struct page`, an attacker-positioned out-of-bounds atomic write into arbitrary kernel memory, and then walks a garbage `address_space`/i_mmap tree. Per the OOB-write guidance this is High.\nA:H - The documented, reproduced impact is a fatal kernel paging fault and panic (\"Unable to handle kernel paging request ... Kernel panic - not syncing: Oops\"), and the corrupted low-memory limits can equally cause the allocator and DMA logic to operate on non-existent DRAM. The condition is triggerable repeatedly at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:49.485Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25f09699edd360b534ccae16bc276c3b52c471f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c3e38a367822f036227dd52bac82dc4a05157e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1ec9faef7e36269ca3ec890972a78effbaeb975"
        },
        {
          "url": "https://git.kernel.org/stable/c/90f5f715550e07cd6a51f80fc3f062d832c8c997"
        },
        {
          "url": "https://git.kernel.org/stable/c/8912814f14e298b83df072fecc1f7ed1b63b1b2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a20b83cf45be2057f3d073506779e52c7fa17f94"
        }
      ],
      "title": "nios2: ensure that memblock.current_limit is set when setting pfn limits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40245",
    "datePublished": "2025-12-04T15:31:34.142Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:49.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b865da18b6cb878f33b5920693d03f23b9c4d1a3",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "830d68f2cb8ab6fb798bb9555016709a9e012af0",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix pgtable prealloc error path\n\nThe following splat was reported:\n\n    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n    Mem abort info:\n      ESR = 0x0000000096000004\n      EC = 0x25: DABT (current EL), IL = 32 bits\n      SET = 0, FnV = 0\n      EA = 0, S1PTW = 0\n      FSC = 0x04: level 0 translation fault\n    Data abort info:\n      ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n      CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n      GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n    user pgtable: 4k pages, 48-bit VAs, pgdp=00000008d0fd8000\n    [0000000000000010] pgd=0000000000000000, p4d=0000000000000000\n    Internal error: Oops: 0000000096000004 [#1]  SMP\n    CPU: 5 UID: 1000 PID: 149076 Comm: Xwayland Tainted: G S                  6.16.0-rc2-00809-g0b6974bb4134-dirty #367 PREEMPT\n    Tainted: [S]=CPU_OUT_OF_SPEC\n    Hardware name: Qualcomm Technologies, Inc. SM8650 HDK (DT)\n    pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n    pc : build_detached_freelist+0x28/0x224\n    lr : kmem_cache_free_bulk.part.0+0x38/0x244\n    sp : ffff000a508c7a20\n    x29: ffff000a508c7a20 x28: ffff000a508c7d50 x27: ffffc4e49d16f350\n    x26: 0000000000000058 x25: 00000000fffffffc x24: 0000000000000000\n    x23: ffff00098c4e1450 x22: 00000000fffffffc x21: 0000000000000000\n    x20: ffff000a508c7af8 x19: 0000000000000002 x18: 00000000000003e8\n    x17: ffff000809523850 x16: ffff000809523820 x15: 0000000000401640\n    x14: ffff000809371140 x13: 0000000000000130 x12: ffff0008b5711e30\n    x11: 00000000001058fa x10: 0000000000000a80 x9 : ffff000a508c7940\n    x8 : ffff000809371ba0 x7 : 781fffe033087fff x6 : 0000000000000000\n    x5 : ffff0008003cd000 x4 : 781fffe033083fff x3 : ffff000a508c7af8\n    x2 : fffffdffc0000000 x1 : 0001000000000000 x0 : ffff0008001a6a00\n    Call trace:\n     build_detached_freelist+0x28/0x224 (P)\n     kmem_cache_free_bulk.part.0+0x38/0x244\n     kmem_cache_free_bulk+0x10/0x1c\n     msm_iommu_pagetable_prealloc_cleanup+0x3c/0xd0\n     msm_vma_job_free+0x30/0x240\n     msm_ioctl_vm_bind+0x1d0/0x9a0\n     drm_ioctl_kernel+0x84/0x104\n     drm_ioctl+0x358/0x4d4\n     __arm64_sys_ioctl+0x8c/0xe0\n     invoke_syscall+0x44/0x100\n     el0_svc_common.constprop.0+0x3c/0xe0\n     do_el0_svc+0x18/0x20\n     el0_svc+0x30/0x100\n     el0t_64_sync_handler+0x104/0x130\n     el0t_64_sync+0x170/0x174\n    Code: aa0203f5 b26287e2 f2dfbfe2 aa0303f4 (f8737ab6)\n    ---[ end trace 0000000000000000 ]---\n\nSince msm_vma_job_free() is called directly from the ioctl, this looks\nlike an error path cleanup issue.  Which I think results from\nprealloc_cleanup() called without a preceding successful\nprealloc_allocate() call.  So handle that case better.\n\nPatchwork: https://patchwork.freedesktop.org/patch/678677/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:45:38.393Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b865da18b6cb878f33b5920693d03f23b9c4d1a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/830d68f2cb8ab6fb798bb9555016709a9e012af0"
        }
      ],
      "title": "drm/msm: Fix pgtable prealloc error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40247",
    "datePublished": "2025-12-04T16:08:10.696Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-05-11T21:45:38.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T12:59:57.735Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40248",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:01:10.557430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:01:18.965Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/af_vsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3f71753935d648082a8279a97d30efe6b85be680",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "da664101fb4a0de5cb70d2bae6a650df954df2af",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "67432915145848658149683101104e32f9fd6559",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "eeca93f06df89be5a36305b7b9dae1ed65550dfc",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "5998da5a8208ae9ad7838ba322bccb2bdcd95e81",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "f1c170cae285e4b8f61be043bb17addc3d0a14b5",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "ab6b19f690d89ae4709fba73a3c4a7911f495b7a",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "002541ef650b742a198e4be363881439bb9d86b4",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/af_vsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.302",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Ignore signal/timeout on connect() if already established\n\nDuring connect(), acting on a signal/timeout by disconnecting an already\nestablished socket leads to several issues:\n\n1. connect() invoking vsock_transport_cancel_pkt() -\u003e\n   virtio_transport_purge_skbs() may race with sendmsg() invoking\n   virtio_transport_get_credit(). This results in a permanently elevated\n   `vvs-\u003ebytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.\n\n2. connect() resetting a connected socket\u0027s state may race with socket\n   being placed in a sockmap. A disconnected socket remaining in a sockmap\n   breaks sockmap\u0027s assumptions. And gives rise to WARNs.\n\n3. connect() transitioning SS_CONNECTED -\u003e SS_UNCONNECTED allows for a\n   transport change/drop after TCP_ESTABLISHED. Which poses a problem for\n   any simultaneous sendmsg() or connect() and may result in a\n   use-after-free/null-ptr-deref.\n\nDo not disconnect socket on signal/timeout. Keep the logic for unconnected\nsockets: they don\u0027t linger, can\u0027t be placed in a sockmap, are rejected by\nsendmsg().\n\n[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/\n[2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/\n[3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered through AF_VSOCK socket syscalls (connect/sendmsg) plus signal delivery from a local process; per kernel scoring guidance vsock is a local attack surface. No network packet from an unauthenticated remote peer can drive the signal/timeout race.\nAC:L - The attacker controls both sides of the race \u2014 the listening peer (vsock_loopback/VMADDR_CID_LOCAL requires no VM), the exact moment of connection establishment, the signal storm from a sibling thread, and the concurrent sendmsg()/second connect() \u2014 and can retry indefinitely until the window is hit.\nPR:L - vsock_create() performs no capability check, so any unprivileged local user (including inside a container) can create AF_VSOCK sockets and reach vsock_connect(). No root, CAP_NET_ADMIN, or namespace trickery is needed.\nUI:N - The attacker\u0027s own threads perform every step \u2014 connect, accept, signal delivery, and the follow-up connect/sendmsg. No victim action is required.\nS:U - The corruption and its impact are confined to the kernel\u0027s own security authority; there is no guest-to-host or IOMMU boundary crossing involved in the freed vsock transport state.\nC:H - The transport change/drop after TCP_ESTABLISHED yields a use-after-free of the kmalloc\u0027d virtio_vsock_sock and a stale transport ops pointer reachable from sendmsg(); heap reclaim of the freed object gives an attacker-controlled read primitive over kernel memory.\nI:H - The same use-after-free permits heap spraying over the freed transport state and invocation of function pointers from a stale ops/module reference, providing a write and control-flow hijack primitive as in prior vsock UAF exploits.\nA:H - The commit explicitly notes use-after-free/NULL-pointer dereference, plus sockmap WARNs and a permanently elevated bytes_unsent that breaks SOCK_LINGER handling \u2014 any of which oops or hang the kernel, and the race can be re-run at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:50.554Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3f71753935d648082a8279a97d30efe6b85be680"
        },
        {
          "url": "https://git.kernel.org/stable/c/da664101fb4a0de5cb70d2bae6a650df954df2af"
        },
        {
          "url": "https://git.kernel.org/stable/c/67432915145848658149683101104e32f9fd6559"
        },
        {
          "url": "https://git.kernel.org/stable/c/eeca93f06df89be5a36305b7b9dae1ed65550dfc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5998da5a8208ae9ad7838ba322bccb2bdcd95e81"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1c170cae285e4b8f61be043bb17addc3d0a14b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab6b19f690d89ae4709fba73a3c4a7911f495b7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/002541ef650b742a198e4be363881439bb9d86b4"
        }
      ],
      "title": "vsock: Ignore signal/timeout on connect() if already established",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40248",
    "datePublished": "2025-12-04T16:08:11.509Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:50.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T12:59:58.884Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69e043bce09c9a77e5f55b9ac7505874a2a1a9f0",
              "status": "affected",
              "version": "3354822cde5a9f72aa725b3c619188b149a71a33",
              "versionType": "git"
            },
            {
              "lessThan": "6ebd02cf2dde11b86f89ea4c9f55179eab30d4ee",
              "status": "affected",
              "version": "3354822cde5a9f72aa725b3c619188b149a71a33",
              "versionType": "git"
            },
            {
              "lessThan": "4d6b4bea8b80bfa13c903ba547538249e7c5e977",
              "status": "affected",
              "version": "3354822cde5a9f72aa725b3c619188b149a71a33",
              "versionType": "git"
            },
            {
              "lessThan": "d47515af6cccd7484d8b0870376858c9848a18ec",
              "status": "affected",
              "version": "3354822cde5a9f72aa725b3c619188b149a71a33",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Clean up only new IRQ glue on request_irq() failure\n\nThe mlx5_irq_alloc() function can inadvertently free the entire rmap\nand end up in a crash[1] when the other threads tries to access this,\nwhen request_irq() fails due to exhausted IRQ vectors. This commit\nmodifies the cleanup to remove only the specific IRQ mapping that was\njust added.\n\nThis prevents removal of other valid mappings and ensures precise\ncleanup of the failed IRQ allocation\u0027s associated glue object.\n\nNote: This error is observed when both fwctl and rds configs are enabled.\n\n[1]\nmlx5_core 0000:05:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:06:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\ngeneral protection fault, probably for non-canonical address\n0xe277a58fde16f291: 0000 [#1] SMP NOPTI\n\nRIP: 0010:free_irq_cpu_rmap+0x23/0x7d\nCall Trace:\n   \u003cTASK\u003e\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   ? __die_body.cold+0x8/0xa\n   ? die_addr+0x39/0x53\n   ? exc_general_protection+0x1c4/0x3e9\n   ? dev_vprintk_emit+0x5f/0x90\n   ? asm_exc_general_protection+0x22/0x27\n   ? free_irq_cpu_rmap+0x23/0x7d\n   mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   irq_pool_request_vector+0x7d/0x90 [mlx5_core]\n   mlx5_irq_request+0x2e/0xe0 [mlx5_core]\n   mlx5_irq_request_vector+0xad/0xf7 [mlx5_core]\n   comp_irq_request_pci+0x64/0xf0 [mlx5_core]\n   create_comp_eq+0x71/0x385 [mlx5_core]\n   ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core]\n   mlx5_comp_eqn_get+0x72/0x90 [mlx5_core]\n   ? xas_load+0x8/0x91\n   mlx5_comp_irqn_get+0x40/0x90 [mlx5_core]\n   mlx5e_open_channel+0x7d/0x3c7 [mlx5_core]\n   mlx5e_open_channels+0xad/0x250 [mlx5_core]\n   mlx5e_open_locked+0x3e/0x110 [mlx5_core]\n   mlx5e_open+0x23/0x70 [mlx5_core]\n   __dev_open+0xf1/0x1a5\n   __dev_change_flags+0x1e1/0x249\n   dev_change_flags+0x21/0x5c\n   do_setlink+0x28b/0xcc4\n   ? __nla_parse+0x22/0x3d\n   ? inet6_validate_link_af+0x6b/0x108\n   ? cpumask_next+0x1f/0x35\n   ? __snmp6_fill_stats64.constprop.0+0x66/0x107\n   ? __nla_validate_parse+0x48/0x1e6\n   __rtnl_newlink+0x5ff/0xa57\n   ? kmem_cache_alloc_trace+0x164/0x2ce\n   rtnl_newlink+0x44/0x6e\n   rtnetlink_rcv_msg+0x2bb/0x362\n   ? __netlink_sendskb+0x4c/0x6c\n   ? netlink_unicast+0x28f/0x2ce\n   ? rtnl_calcit.isra.0+0x150/0x146\n   netlink_rcv_skb+0x5f/0x112\n   netlink_unicast+0x213/0x2ce\n   netlink_sendmsg+0x24f/0x4d9\n   __sock_sendmsg+0x65/0x6a\n   ____sys_sendmsg+0x28f/0x2c9\n   ? import_iovec+0x17/0x2b\n   ___sys_sendmsg+0x97/0xe0\n   __sys_sendmsg+0x81/0xd8\n   do_syscall_64+0x35/0x87\n   entry_SYSCALL_64_after_hwframe+0x6e/0x0\nRIP: 0033:0x7fc328603727\nCode: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed\nff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 00\nf0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48\nRSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727\nRDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d\nRBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\nR13: 00000000000\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered only from local interfaces \u2014 rtnetlink/ethtool link-up (`mlx5e_open` \u2192 `create_comp_eq`) or the RDMA uverbs `CREATE_CQ` ioctl supplying `comp_vector` \u2014 not from processing received packets. The dangling `netdev-\u003erx_cpu_rmap` is later consumed in the RX softirq, but the attacker\u0027s trigger for the free is purely local.\nAC:L - The attacker drives the triggering condition themselves by repeatedly allocating completion vectors (CQ per comp_vector across mlx5 uverbs devices, or channel/link-up cycles) until MSI-X/x86 vector space is exhausted and `request_irq()` returns -ENOSPC; the very next allocation attempt deterministically executes the buggy cleanup. `CONFIG_RFS_ACCEL` is `default y`, so no rare config is needed, and the dangling `eq_table-\u003ermap`/`rx_cpu_rmap` pointers persist afterwards with no race to win.\nPR:L - `mlx5_comp_eqn_get()` is reachable from `ib_uverbs_create_cq` with a user-chosen `comp_vector` and requires no capability beyond an open handle on `/dev/infiniband/uverbs*`, which rdma-core udev rules commonly expose mode 0666 on exactly the RDMA/HPC hosts that carry mlx5 hardware. An unprivileged local user can therefore force the dynamic IRQ allocations and the `request_irq()` failure.\nUI:N - No victim action is required; the attacker\u0027s own syscalls allocate the completion queues and trigger the failing IRQ request, and the resulting stale pointer is consumed by kernel teardown and RX steering without any user involvement.\nS:U - The premature free and all subsequent corruption occur within the kernel\u0027s own slab and driver state; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free of the `struct cpu_rmap` \u2014 `free_irq_cpu_rmap()` and `cpu_rmap_lookup_obj()` read `rmap-\u003eobj[]`/`rmap-\u003enear[]` out of a freed, sprayable kmalloc object, and `set_rps_cpu()` uses the freed `rx_cpu_rmap` index to address `dev-\u003e_rx` out of bounds, giving an attacker who reclaims the slot a kernel-memory read primitive.\nI:H - After the free, `irq_cpu_rmap_add()` performs `kref_get()` and `rmap-\u003eobj[index] = glue` into the reallocated object, and `free_irq_cpu_rmap()` runs `irq_set_affinity_notifier()`/`kref_put()` on a fully attacker-controlled `glue` pointer read from freed memory \u2014 refcount manipulation, controlled pointer write, and a double-free path suitable for control-flow hijack.\nA:H - The reported failure is a general protection fault in `free_irq_cpu_rmap+0x23` ending in \"Kernel panic - not syncing: Fatal exception\", and any thread touching the stale `eq_table-\u003ermap` or `netdev-\u003erx_cpu_rmap` can crash the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:52.687Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69e043bce09c9a77e5f55b9ac7505874a2a1a9f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ebd02cf2dde11b86f89ea4c9f55179eab30d4ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d6b4bea8b80bfa13c903ba547538249e7c5e977"
        },
        {
          "url": "https://git.kernel.org/stable/c/d47515af6cccd7484d8b0870376858c9848a18ec"
        }
      ],
      "title": "net/mlx5: Clean up only new IRQ glue on request_irq() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40250",
    "datePublished": "2025-12-04T16:08:12.984Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:52.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:01.139Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40251",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:14.789338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:10.307Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/devlink/rate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90e51e20bcec9bff5b2421ce1bd95704764655f5",
              "status": "affected",
              "version": "d7555984507822458b32a6405881038241d140be",
              "versionType": "git"
            },
            {
              "lessThan": "715d9cda646a8a38ea8b2bb5afb679a7464055e2",
              "status": "affected",
              "version": "d7555984507822458b32a6405881038241d140be",
              "versionType": "git"
            },
            {
              "lessThan": "c70df6c17d389cc743f0eb30160e2d6bc6910db8",
              "status": "affected",
              "version": "d7555984507822458b32a6405881038241d140be",
              "versionType": "git"
            },
            {
              "lessThan": "542f45486f1ce2d2dde75bd85aca0389ef7046c3",
              "status": "affected",
              "version": "d7555984507822458b32a6405881038241d140be",
              "versionType": "git"
            },
            {
              "lessThan": "f94c1a114ac209977bdf5ca841b98424295ab1f0",
              "status": "affected",
              "version": "d7555984507822458b32a6405881038241d140be",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/devlink/rate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevlink: rate: Unset parent pointer in devl_rate_nodes_destroy\n\nThe function devl_rate_nodes_destroy is documented to \"Unset parent for\nall rate objects\". However, it was only calling the driver-specific\n`rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing\nthe parent\u0027s refcount, without actually setting the\n`devlink_rate-\u003eparent` pointer to NULL.\n\nThis leaves a dangling pointer in the `devlink_rate` struct, which cause\nrefcount error in netdevsim[1] and mlx5[2]. In addition, this is\ninconsistent with the behavior of `devlink_nl_rate_parent_node_set`,\nwhere the parent pointer is correctly cleared.\n\nThis patch fixes the issue by explicitly setting `devlink_rate-\u003eparent`\nto NULL after notifying the driver, thus fulfilling the function\u0027s\ndocumented behavior for all rate objects.\n\n[1]\nrepro steps:\necho 1 \u003e /sys/bus/netdevsim/new_device\ndevlink dev eswitch set netdevsim/netdevsim1 mode switchdev\necho 1 \u003e /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs\ndevlink port function rate add netdevsim/netdevsim1/test_node\ndevlink port function rate set netdevsim/netdevsim1/128 parent test_node\necho 1 \u003e /sys/bus/netdevsim/del_device\n\ndmesg:\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\nCPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\nCall Trace:\n \u003cTASK\u003e\n devl_rate_leaf_destroy+0x8d/0x90\n __nsim_dev_port_del+0x6c/0x70 [netdevsim]\n nsim_dev_reload_destroy+0x11c/0x140 [netdevsim]\n nsim_drv_remove+0x2b/0xb0 [netdevsim]\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xc6/0x130\n device_del+0x159/0x3c0\n device_unregister+0x1a/0x60\n del_device_store+0x111/0x170 [netdevsim]\n kernfs_fop_write_iter+0x12e/0x1e0\n vfs_write+0x215/0x3d0\n ksys_write+0x5f/0xd0\n do_syscall_64+0x55/0x10f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n[2]\ndevlink dev eswitch set pci/0000:08:00.0 mode switchdev\ndevlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000\ndevlink port function rate add pci/0000:08:00.0/group1\ndevlink port function rate set pci/0000:08:00.0/32768 parent group1\nmodprobe -r mlx5_ib mlx5_fwctl mlx5_core\n\ndmesg:\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\nCPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\nCall Trace:\n \u003cTASK\u003e\n devl_rate_leaf_destroy+0x8d/0x90\n mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core]\n mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core]\n mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core]\n mlx5_sf_esw_event+0xc4/0x120 [mlx5_core]\n notifier_call_chain+0x33/0xa0\n blocking_notifier_call_chain+0x3b/0x50\n mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core]\n mlx5_eswitch_disable+0x63/0x90 [mlx5_core]\n mlx5_unload+0x1d/0x170 [mlx5_core]\n mlx5_uninit_one+0xa2/0x130 [mlx5_core]\n remove_one+0x78/0xd0 [mlx5_core]\n pci_device_remove+0x39/0xa0\n device_release_driver_internal+0x194/0x1f0\n unbind_store+0x99/0xa0\n kernfs_fop_write_iter+0x12e/0x1e0\n vfs_write+0x215/0x3d0\n ksys_write+0x5f/0xd0\n do_syscall_64+0x53/0x1f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling `devlink_rate-\u003eparent` is dereferenced from the devlink generic-netlink interface (`DEVLINK_CMD_RATE_GET` dump) and from local device/eswitch reconfiguration paths reached via netlink and sysfs. No network packet processing is involved, so this is local-only.\nAC:L - Once `devl_rate_nodes_destroy()` runs (SR-IOV teardown, eswitch mode change, driver reload \u2014 routine in SR-IOV/DPU cloud hosts), the stale parent pointer persists in surviving leaf rate objects, so there is no race to win: the attacker sprays the 120-byte kmalloc-128 slot and then deterministically triggers the deref with an unprivileged `devlink port function rate show`. The reproducers in the commit message are deterministic one-shot command sequences.\nPR:L - The vulnerable dereference sites \u2014 `devlink_nl_rate_fill()` reading `devlink_rate-\u003eparent-\u003ename` and emitting it to userspace \u2014 sit behind `DEVLINK_CMD_RATE_GET`, which carries only `GENL_CMD_CAP_DO|DUMP` with no `GENL_ADMIN_PERM` and no family-level gate, so an ordinary unprivileged local user reaches the freed object and obtains the read primitive. Only the state-creating teardown needs CAP_NET_ADMIN, and that occurs as routine orchestration activity on the affected mlx5/ice/netdevsim hosts.\nUI:N - No victim must open a file, mount a filesystem, or interact in any way; the attacker issues the netlink dump (or the whole command sequence) themselves. Exploitation completes entirely within attacker-issued syscalls.\nS:U - The use-after-free read and write are confined to kernel slab memory under the same security authority as the kernel itself. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `nla_put_string(msg, DEVLINK_ATTR_RATE_PARENT_NODE_NAME, devlink_rate-\u003eparent-\u003ename)` loads a pointer from offset 64 of the freed `struct devlink_rate` and copies the string it points at back to userspace; after reclaiming the kmalloc-128 slot with controlled data this is an unbounded arbitrary kernel-memory read delivered over an unprivileged netlink dump.\nI:H - `devl_rate_leaf_destroy()` performs `refcount_dec()` on offset 72 of the freed object, giving a controlled decrement primitive against whatever kmalloc-128 object reclaims the slot \u2014 dropping a live object\u0027s refcount to zero yields a second use-after-free and the standard heap-spray path to arbitrary write and control-flow hijack.\nA:H - Even without reclamation the bug reliably produces `refcount_warn_saturate` WARNINGs (\"decrement hit 0; leaking memory\") as shown in both netdevsim and mlx5 traces, which panic the box under `panic_on_warn`; with a reclaimed slot the corrupted refcount causes premature frees, slab corruption, and oops on the subsequent dangling-pointer string dereference."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:53.761Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90e51e20bcec9bff5b2421ce1bd95704764655f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/715d9cda646a8a38ea8b2bb5afb679a7464055e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c70df6c17d389cc743f0eb30160e2d6bc6910db8"
        },
        {
          "url": "https://git.kernel.org/stable/c/542f45486f1ce2d2dde75bd85aca0389ef7046c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f94c1a114ac209977bdf5ca841b98424295ab1f0"
        }
      ],
      "title": "devlink: rate: Unset parent pointer in devl_rate_nodes_destroy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40251",
    "datePublished": "2025-12-04T16:08:13.710Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:53.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:07.644Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qlogic/qede/qede_fp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ecbb12caf399d7cf364b7553ed5aebeaa2f255bc",
              "status": "affected",
              "version": "55482edc25f0606851de42e73618f813f310d009",
              "versionType": "git"
            },
            {
              "lessThan": "a778912b4a53587ea07d85526d152f85d109cbfe",
              "status": "affected",
              "version": "55482edc25f0606851de42e73618f813f310d009",
              "versionType": "git"
            },
            {
              "lessThan": "f0923011c1261b33a2ac1de349256d39cb750dd0",
              "status": "affected",
              "version": "55482edc25f0606851de42e73618f813f310d009",
              "versionType": "git"
            },
            {
              "lessThan": "917a9d02182ac8b4f25eb47dc02f3ec679608c24",
              "status": "affected",
              "version": "55482edc25f0606851de42e73618f813f310d009",
              "versionType": "git"
            },
            {
              "lessThan": "e441db07f208184e0466abf44b389a81d70c340e",
              "status": "affected",
              "version": "55482edc25f0606851de42e73618f813f310d009",
              "versionType": "git"
            },
            {
              "lessThan": "896f1a2493b59beb2b5ccdf990503dbb16cb2256",
              "status": "affected",
              "version": "55482edc25f0606851de42e73618f813f310d009",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qlogic/qede/qede_fp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\n\nThe loops in \u0027qede_tpa_cont()\u0027 and \u0027qede_tpa_end()\u0027, iterate\nover \u0027cqe-\u003elen_list[]\u0027 using only a zero-length terminator as\nthe stopping condition. If the terminator was missing or\nmalformed, the loop could run past the end of the fixed-size array.\n\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\na potential out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable TPA/GRO completion-descriptor handling runs in the qede NAPI receive path, driven entirely by packets arriving from the network on a Marvell/QLogic FastLinQ NIC typically deployed in internet-facing datacenter and cloud servers. The `len_list[]` contents are produced by hardware coalescing of remotely-sent TCP segments, so an off-path/remote peer supplies the data that drives the loop.\nAC:L - The overrun occurs whenever the aggregation fills all `len_list[]` slots leaving no zero terminator, a condition an attacker steers directly by sending high-rate/crafted TCP bursts that maximize the number of BDs per aggregation. No unpredictable memory layout or victim state is required, and the attack can be repeated indefinitely until it lands.\nPR:N - Sending Ethernet/TCP traffic to a host requires no credentials or account on the target; the RX path processes frames before any authentication or socket-level authorization. The driver parses the completion descriptor unconditionally in softirq context.\nUI:N - Packet reception and TPA aggregation happen automatically in the NAPI poll routine with no involvement from any logged-in user. No file must be opened, no filesystem mounted, and no configuration action performed.\nS:U - The out-of-bounds read and the resulting skb fragment-array corruption are confined to kernel memory under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop reads past `len_list[]` into adjacent DMA-mapped completion-ring memory, and the resulting garbage lengths are used to build skb fragments at arbitrary offsets/sizes within RX pages, which `napi_gro_receive()` then delivers up the stack to sockets \u2014 leaking uninitialized kernel/RX-ring memory to a remote peer.\nI:H - `qede_fill_frag_skb()` increments `tpa_info-\u003efrag_id` with no `MAX_SKB_FRAGS` bound, so the extra iterations write page pointer/offset/length triplets past `skb_shinfo(skb)-\u003efrags[]` \u2014 a controllable heap out-of-bounds write \u2014 and simultaneously over-consume the RX BD ring, corrupting driver state and adjacent slab objects in a way exploitable for control-flow hijack.\nA:H - Overrunning the skb shared-info fragment array and desynchronizing the RX BD ring reliably produces oops/panic (bad page state, DMA unmap of bogus mappings, refcount corruption) in softirq context, taking the machine down. The condition is remotely repeatable, so recovery is not possible while the attacker keeps sending traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:54.857Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ecbb12caf399d7cf364b7553ed5aebeaa2f255bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a778912b4a53587ea07d85526d152f85d109cbfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0923011c1261b33a2ac1de349256d39cb750dd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/917a9d02182ac8b4f25eb47dc02f3ec679608c24"
        },
        {
          "url": "https://git.kernel.org/stable/c/e441db07f208184e0466abf44b389a81d70c340e"
        },
        {
          "url": "https://git.kernel.org/stable/c/896f1a2493b59beb2b5ccdf990503dbb16cb2256"
        }
      ],
      "title": "net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40252",
    "datePublished": "2025-12-04T16:08:14.393Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:54.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/net/ctcm_mpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "06f1dd1de0d33dbfbd2e1fc9fc57d8895f730de2",
              "status": "affected",
              "version": "467ddbbe7e749d558f13e640f50f546149c930b3",
              "versionType": "git"
            },
            {
              "lessThan": "6bf8ccaabce8cebb6cb1f255c93d0acdfe95c17a",
              "status": "affected",
              "version": "4d3c6d741816539b57fa1110c3f765a8c176d7b4",
              "versionType": "git"
            },
            {
              "lessThan": "7616e2eee679746d526c7f5befd4eedb995935b5",
              "status": "affected",
              "version": "2bd57101c3ecf3f8c0da1d26c2b6ad511adc6d50",
              "versionType": "git"
            },
            {
              "lessThan": "43096dab8cc60fc39133205fd149a54d3acebea8",
              "status": "affected",
              "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a",
              "versionType": "git"
            },
            {
              "lessThan": "3b177b2ded563df16f6d5920671ffcfe5915d472",
              "status": "affected",
              "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a",
              "versionType": "git"
            },
            {
              "lessThan": "b9dbfb1b5699f9f1e4991f96741bdf9047147589",
              "status": "affected",
              "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a",
              "versionType": "git"
            },
            {
              "lessThan": "7ff76f8dc6b550f8d16487bf3cebc278be720b5c",
              "status": "affected",
              "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a",
              "versionType": "git"
            },
            {
              "lessThan": "da02a1824884d6c84c5e5b5ac373b0c9e3288ec2",
              "status": "affected",
              "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "36933de59f67029e5739a98393891f9b94f27e0f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d886b4292a1c5b4facdb2dfdc31f0fecc71df898",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4c9ba0fed125deba8416b995b0c274b0804c0c24",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea0053af5dab4d63a9c44563973fb2f3bfd9eb2b",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.302",
              "status": "affected",
              "version": "5.4.195",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.247",
              "status": "affected",
              "version": "5.10.117",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.197",
              "status": "affected",
              "version": "5.15.41",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.315",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.280",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.244",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/net/ctcm_mpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.302",
                  "versionStartIncluding": "5.4.195",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "5.10.117",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "5.15.41",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.315",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.280",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.244",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ctcm: Fix double-kfree\n\nThe function \u0027mpc_rcvd_sweep_req(mpcginfo)\u0027 is called conditionally\nfrom function \u0027ctcmpc_unpack_skb\u0027. It frees passed mpcginfo.\nAfter that a call to function \u0027kfree\u0027 in function \u0027ctcmpc_unpack_skb\u0027\nfrees it again.\n\nRemove \u0027kfree\u0027 call in function \u0027mpc_rcvd_sweep_req(mpcginfo)\u0027.\n\nBug detected by the clang static analyzer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malicious `TH_SWEEP_REQ` transmission header is delivered as a link-level MPC frame by the directly-attached CTC peer (a partner LPAR or a z/VM guest coupled via virtual CTCA), reaching `ctcmpc_unpack_skb()` straight from the channel read interrupt. MPC TH headers are regenerated per link and not routable, so the attacker must sit on the adjacent channel connection rather than across a routed network.\nAC:L - A single frame with `th_ch_flag = 0xfe` deterministically drives `ctcmpc_unpack_skb()` into `mpc_rcvd_sweep_req()` and the two consecutive `kfree()` calls every time \u2014 no race, no timing window, and no memory-layout precondition outside the attacker\u0027s control.\nPR:N - The attacker needs no account, credential, or capability on the target Linux image; it only has to be the CTC peer, and the path is reachable both in `MPCG_STATE_READY` and during the pre-establishment XID-negotiation states, where no authentication of any kind has occurred.\nUI:N - The remote peer triggers the double free entirely on its own by transmitting one frame on an already-active CTC link; no administrator or user action on the victim system is needed at attack time.\nS:U - The slab corruption occurs in the receiving kernel\u0027s own softirq/tasklet context and its consequences stay within that kernel\u0027s security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - On kernels without freelist hardening the double free leaves the kmalloc-64 percpu freelist self-referential, so repeated allocations hand the same 40-byte object to unrelated kernel structures, yielding an aliasing/use-after-free primitive that exposes arbitrary kernel memory contents to the attacker-controlled objects.\nI:H - The same freelist corruption lets attacker-influenced allocations overlap live kernel objects (type confusion), giving a write primitive over adjacent/aliased kernel data and a realistic path to control-flow hijack \u2014 classic exploitable heap corruption, not a mere accounting error.\nA:H - With `CONFIG_SLAB_FREELIST_HARDENED` the immediate double free hits `BUG_ON(object == fp)` in `set_freepointer()` inside a tasklet, which is fatal in interrupt context; without it the corrupted freelist causes near-certain crashes, and either outcome is re-triggerable at will by the peer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:55.944Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/06f1dd1de0d33dbfbd2e1fc9fc57d8895f730de2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bf8ccaabce8cebb6cb1f255c93d0acdfe95c17a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7616e2eee679746d526c7f5befd4eedb995935b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/43096dab8cc60fc39133205fd149a54d3acebea8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b177b2ded563df16f6d5920671ffcfe5915d472"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9dbfb1b5699f9f1e4991f96741bdf9047147589"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ff76f8dc6b550f8d16487bf3cebc278be720b5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/da02a1824884d6c84c5e5b5ac373b0c9e3288ec2"
        }
      ],
      "title": "s390/ctcm: Fix double-kfree",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40253",
    "datePublished": "2025-12-04T16:08:15.340Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:55.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:09.064Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40254",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:43:38.577278Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:43:48.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c",
            "net/openvswitch/flow_netlink.c",
            "net/openvswitch/flow_netlink.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3415faa1fcb4150f29a72c5ecf959339d797feb7",
              "status": "affected",
              "version": "b2d0f5d5dc53532e6f07bc546a476a55ebdfe0f3",
              "versionType": "git"
            },
            {
              "lessThan": "3d2e7d3b28469081ccf08301df07cc411a1cc5e9",
              "status": "affected",
              "version": "b2d0f5d5dc53532e6f07bc546a476a55ebdfe0f3",
              "versionType": "git"
            },
            {
              "lessThan": "f95bef5ba0b88d971b02c776f24bd17544930a3a",
              "status": "affected",
              "version": "b2d0f5d5dc53532e6f07bc546a476a55ebdfe0f3",
              "versionType": "git"
            },
            {
              "lessThan": "87d2429381ddcf8cbd30c8c36793a4f7916d5f99",
              "status": "affected",
              "version": "b2d0f5d5dc53532e6f07bc546a476a55ebdfe0f3",
              "versionType": "git"
            },
            {
              "lessThan": "0b903f33c31c82b1c3591279fd8a23893802b987",
              "status": "affected",
              "version": "b2d0f5d5dc53532e6f07bc546a476a55ebdfe0f3",
              "versionType": "git"
            },
            {
              "lessThan": "9c61d8fe1350b7322f4953318165d6719c3b1475",
              "status": "affected",
              "version": "b2d0f5d5dc53532e6f07bc546a476a55ebdfe0f3",
              "versionType": "git"
            },
            {
              "lessThan": "4689ba45296dbb3a47e70a1bc2ed0328263e48f3",
              "status": "affected",
              "version": "b2d0f5d5dc53532e6f07bc546a476a55ebdfe0f3",
              "versionType": "git"
            },
            {
              "lessThan": "dfe28c4167a9259fc0c372d9f9473e1ac95cff67",
              "status": "affected",
              "version": "b2d0f5d5dc53532e6f07bc546a476a55ebdfe0f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c",
            "net/openvswitch/flow_netlink.c",
            "net/openvswitch/flow_netlink.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.302",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: remove never-working support for setting nsh fields\n\nThe validation of the set(nsh(...)) action is completely wrong.\nIt runs through the nsh_key_put_from_nlattr() function that is the\nsame function that validates NSH keys for the flow match and the\npush_nsh() action.  However, the set(nsh(...)) has a very different\nmemory layout.  Nested attributes in there are doubled in size in\ncase of the masked set().  That makes proper validation impossible.\n\nThere is also confusion in the code between the \u0027masked\u0027 flag, that\nsays that the nested attributes are doubled in size containing both\nthe value and the mask, and the \u0027is_mask\u0027 that says that the value\nwe\u0027re parsing is the mask.  This is causing kernel crash on trying to\nwrite into mask part of the match with SW_FLOW_KEY_PUT() during\nvalidation, while validate_nsh() doesn\u0027t allocate any memory for it:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)\n  RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch]\n  Call Trace:\n   \u003cTASK\u003e\n   validate_nsh+0x60/0x90 [openvswitch]\n   validate_set.constprop.0+0x270/0x3c0 [openvswitch]\n   __ovs_nla_copy_actions+0x477/0x860 [openvswitch]\n   ovs_nla_copy_actions+0x8d/0x100 [openvswitch]\n   ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch]\n   genl_family_rcv_msg_doit+0xdb/0x130\n   genl_family_rcv_msg+0x14b/0x220\n   genl_rcv_msg+0x47/0xa0\n   netlink_rcv_skb+0x53/0x100\n   genl_rcv+0x24/0x40\n   netlink_unicast+0x280/0x3b0\n   netlink_sendmsg+0x1f7/0x430\n   ____sys_sendmsg+0x36b/0x3a0\n   ___sys_sendmsg+0x87/0xd0\n   __sys_sendmsg+0x6d/0xd0\n   do_syscall_64+0x7b/0x2c0\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe third issue with this process is that while trying to convert\nthe non-masked set into masked one, validate_set() copies and doubles\nthe size of the OVS_KEY_ATTR_NSH as if it didn\u0027t have any nested\nattributes.  It should be copying each nested attribute and doubling\nthem in size independently.  And the process must be properly reversed\nduring the conversion back from masked to a non-masked variant during\nthe flow dump.\n\nIn the end, the only two outcomes of trying to use this action are\neither validation failure or a kernel crash.  And if somehow someone\nmanages to install a flow with such an action, it will most definitely\nnot do what it is supposed to, since all the keys and the masks are\nmixed up.\n\nFixing all the issues is a complex task as it requires re-writing\nmost of the validation code.\n\nGiven that and the fact that this functionality never worked since\nintroduction, let\u0027s just remove it altogether.  It\u0027s better to\nre-introduce it later with a proper implementation instead of trying\nto fix it in stable releases."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:45:46.643Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3415faa1fcb4150f29a72c5ecf959339d797feb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d2e7d3b28469081ccf08301df07cc411a1cc5e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f95bef5ba0b88d971b02c776f24bd17544930a3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/87d2429381ddcf8cbd30c8c36793a4f7916d5f99"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b903f33c31c82b1c3591279fd8a23893802b987"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c61d8fe1350b7322f4953318165d6719c3b1475"
        },
        {
          "url": "https://git.kernel.org/stable/c/4689ba45296dbb3a47e70a1bc2ed0328263e48f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfe28c4167a9259fc0c372d9f9473e1ac95cff67"
        }
      ],
      "title": "net: openvswitch: remove never-working support for setting nsh fields",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40254",
    "datePublished": "2025-12-04T16:08:16.305Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-06-16T19:43:48.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}