{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk_queue.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1463cd066f32efd56ddfd3ac4e3524200f362980",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "5b5fffa7c81e55d8c8edf05ad40d811ec7047e21",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "07ca98f906a403637fc5e513a872a50ef1247f3b",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk_queue.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Harden userspace-supplied xdp_desc validation\n\nTurned out certain clearly invalid values passed in xdp_desc from\nuserspace can pass xp_{,un}aligned_validate_desc() and then lead\nto UBs or just invalid frames to be queued for xmit.\n\ndesc-\u003elen close to ``U32_MAX`` with a non-zero pool-\u003etx_metadata_len\ncan cause positive integer overflow and wraparound, the same way low\nenough desc-\u003eaddr with a non-zero pool-\u003etx_metadata_len can cause\nnegative integer overflow. Both scenarios can then pass the\nvalidation successfully.\nThis doesn\u0027t happen with valid XSk applications, but can be used\nto perform attacks.\n\nAlways promote desc-\u003elen to ``u64`` first to exclude positive\noverflows of it. Use explicit check_{add,sub}_overflow() when\nvalidating desc-\u003eaddr (which is ``u64`` already).\n\nbloat-o-meter reports a little growth of the code size:\n\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)\nFunction                                     old     new   delta\nxskq_cons_peek_desc                          299     330     +31\nxsk_tx_peek_release_desc_batch               973    1002     +29\nxsk_generic_xmit                            3148    3132     -16\n\nbut hopefully this doesn\u0027t hurt the performance much."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malicious xdp_desc values are written by a local process into its own mmap\u0027d AF_XDP TX ring and triggered via sendto()/sendmsg(); this is a local syscall interface, not remote network data processing.\nAC:L - The attacker fully controls desc-\u003eaddr, desc-\u003elen, desc-\u003eoptions, and pool-\u003etx_metadata_len, so the overflow is triggered deterministically with no race or external condition.\nPR:L - AF_XDP socket creation only requires CAP_NET_RAW in the socket\u0027s user namespace, which an unprivileged user obtains via `unshare -Urn`; no real root is needed.\nUI:N - The attacking process performs socket setup, descriptor crafting, and transmission entirely on its own; no other user\u0027s interaction is required.\nS:U - The overflow corrupts kernel memory within the same kernel security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The bypassed length validation causes an out-of-bounds read of up to ~4GB from kernel memory adjacent to the umem buffer, which is copied into transmitted skb data \u2014 an arbitrary kernel memory disclosure primitive.\nI:H - The invalid len/addr drive get_page() on arbitrary \"struct page\" pointers past the pages array and queue corrupted frames, providing a heap/memory-corruption primitive exploitable beyond a mere crash.\nA:H - Out-of-bounds access to the pages array and refcounting of garbage pointers reliably oops/panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:09.151Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1463cd066f32efd56ddfd3ac4e3524200f362980"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b5fffa7c81e55d8c8edf05ad40d811ec7047e21"
        },
        {
          "url": "https://git.kernel.org/stable/c/07ca98f906a403637fc5e513a872a50ef1247f3b"
        }
      ],
      "title": "xsk: Harden userspace-supplied xdp_desc validation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40159",
    "datePublished": "2025-11-12T10:24:36.104Z",
    "dateReserved": "2025-04-16T07:20:57.176Z",
    "dateUpdated": "2026-08-05T12:08:09.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40164",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:05.458823Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:19.209Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/usbnet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6635e52bc4165793aefd686962d912d73d323afe",
              "status": "affected",
              "version": "43daa96b166c3cf5ff30dfac0c5efa2620e4beab",
              "versionType": "git"
            },
            {
              "lessThan": "65d04291adf7c59338f87aab9c6fe0bfa9993e64",
              "status": "affected",
              "version": "43daa96b166c3cf5ff30dfac0c5efa2620e4beab",
              "versionType": "git"
            },
            {
              "lessThan": "f45fffae5e2549bd0a4670cc52a15ad54c9f121e",
              "status": "affected",
              "version": "43daa96b166c3cf5ff30dfac0c5efa2620e4beab",
              "versionType": "git"
            },
            {
              "lessThan": "17fbad93879e87a334062882b45fa727ba1b3dd7",
              "status": "affected",
              "version": "43daa96b166c3cf5ff30dfac0c5efa2620e4beab",
              "versionType": "git"
            },
            {
              "lessThan": "d1944bab8e0c1511f0cbf364aa06547735bb0ddb",
              "status": "affected",
              "version": "43daa96b166c3cf5ff30dfac0c5efa2620e4beab",
              "versionType": "git"
            },
            {
              "lessThan": "0134c7bff14bd50314a4f92b182850ddfc38e255",
              "status": "affected",
              "version": "43daa96b166c3cf5ff30dfac0c5efa2620e4beab",
              "versionType": "git"
            },
            {
              "lessThan": "327cd4b68b4398b6c24f10eb2b2533ffbfc10185",
              "status": "affected",
              "version": "43daa96b166c3cf5ff30dfac0c5efa2620e4beab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/usbnet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Fix using smp_processor_id() in preemptible code warnings\n\nSyzbot reported the following warning:\n\nBUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879\ncaller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331\nCPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary)\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120\n check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49\n usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331\n usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708\n usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417\n __dev_set_mtu net/core/dev.c:9443 [inline]\n netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496\n netif_set_mtu+0xb0/0x160 net/core/dev.c:9520\n dev_set_mtu+0xae/0x170 net/core/dev_api.c:247\n dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572\n dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821\n sock_do_ioctl+0x19d/0x280 net/socket.c:1204\n sock_ioctl+0x42f/0x6a0 net/socket.c:1311\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl fs/ioctl.c:892 [inline]\n __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFor historical and portability reasons, the netif_rx() is usually\nrun in the softirq or interrupt context, this commit therefore add\nlocal_bh_disable/enable() protection in the usbnet_resume_rx()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T11:57:22.439Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6635e52bc4165793aefd686962d912d73d323afe"
        },
        {
          "url": "https://git.kernel.org/stable/c/65d04291adf7c59338f87aab9c6fe0bfa9993e64"
        },
        {
          "url": "https://git.kernel.org/stable/c/f45fffae5e2549bd0a4670cc52a15ad54c9f121e"
        },
        {
          "url": "https://git.kernel.org/stable/c/17fbad93879e87a334062882b45fa727ba1b3dd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1944bab8e0c1511f0cbf364aa06547735bb0ddb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0134c7bff14bd50314a4f92b182850ddfc38e255"
        },
        {
          "url": "https://git.kernel.org/stable/c/327cd4b68b4398b6c24f10eb2b2533ffbfc10185"
        }
      ],
      "title": "usbnet: Fix using smp_processor_id() in preemptible code warnings",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40164",
    "datePublished": "2025-11-12T10:26:23.482Z",
    "dateReserved": "2025-04-16T07:20:57.176Z",
    "dateUpdated": "2026-06-19T11:57:22.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40168",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:59:59.004592Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:00:14.873Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_clc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3f119c37aa293af41400cccb3d89fab8dcf774b0",
              "status": "affected",
              "version": "a046d57da19f812216f393e7c535f5858f793ac3",
              "versionType": "git"
            },
            {
              "lessThan": "4f5f52a5842937f945582a93cb9daed9ea526fee",
              "status": "affected",
              "version": "a046d57da19f812216f393e7c535f5858f793ac3",
              "versionType": "git"
            },
            {
              "lessThan": "326e5cf301d0bec0a672aa834d8254c4f9df6255",
              "status": "affected",
              "version": "a046d57da19f812216f393e7c535f5858f793ac3",
              "versionType": "git"
            },
            {
              "lessThan": "d26e80f7fb62d77757b67a1b94e4ac756bc9c658",
              "status": "affected",
              "version": "a046d57da19f812216f393e7c535f5858f793ac3",
              "versionType": "git"
            },
            {
              "lessThan": "235f81045c008169cc4e1955b4a64e118eebe61b",
              "status": "affected",
              "version": "a046d57da19f812216f393e7c535f5858f793ac3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_clc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.187",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.156",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().\n\nsmc_clc_prfx_match() is called from smc_listen_work() and\nnot under RCU nor RTNL.\n\nUsing sk_dst_get(sk)-\u003edev could trigger UAF.\n\nLet\u0027s use __sk_dst_get() and dst_dev_rcu().\n\nNote that the returned value of smc_clc_prfx_match() is not\nused in the caller."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable read is performed by the SMC listen worker while parsing a CLC Proposal message received over TCP from a remote peer (smc_listen_work \u2192 smc_listen_find_device \u2192 smc_listen_prfx_check \u2192 smc_clc_prfx_match), and the peer controls the fields that select and drive the code path. Any host running an AF_SMC listener is exposed to unauthenticated remote connections.\nAC:H - The attacker fully controls one side of the race (when the CLC Proposal arrives and thus when the stale dst-\u003edev is dereferenced), but the other side requires the route\u0027s net_device to be concurrently torn down via dst_dev_put()/free_netdev(), which a remote attacker cannot induce or time.\nPR:N - The CLC handshake is the first exchange on the connection and SMC performs no authentication before smc_clc_prfx_match() runs, so an unauthenticated remote attacker reaches the bug with no credentials of any kind.\nUI:N - Triggering requires only that the attacker complete a TCP handshake with the SMC option and send a CLC Proposal; no action by any local user or administrator is needed.\nS:U - The use-after-free is confined to kernel memory (the net_device slab and the in_dev/inet6_dev structures it points at) within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed net_device is dereferenced and its ifa_list/addr_list walked, and since a reclaimed slab can be groomed with attacker-controlled data this yields an arbitrary kernel-memory read primitive; the match/no-match outcome is additionally returned to the peer as SMC_CLC_DECL_DIFFPREFIX, forming a remotely observable oracle on freed memory contents.\nI:H - A use-after-free of a net_device is a heap-corruption primitive: the reclaimed object\u0027s contents are attacker-influencable via heap spraying and the code follows pointers out of it, which can be groomed into an arbitrary write and control-flow hijack.\nA:H - Dereferencing the freed net_device and walking a bogus in_dev/inet6_dev address list reliably produces a kernel oops, panic, or an unbounded list walk, crashing the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T12:49:28.040Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3f119c37aa293af41400cccb3d89fab8dcf774b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f5f52a5842937f945582a93cb9daed9ea526fee"
        },
        {
          "url": "https://git.kernel.org/stable/c/326e5cf301d0bec0a672aa834d8254c4f9df6255"
        },
        {
          "url": "https://git.kernel.org/stable/c/d26e80f7fb62d77757b67a1b94e4ac756bc9c658"
        },
        {
          "url": "https://git.kernel.org/stable/c/235f81045c008169cc4e1955b4a64e118eebe61b"
        }
      ],
      "title": "smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40168",
    "datePublished": "2025-11-12T10:46:51.422Z",
    "dateReserved": "2025-04-16T07:20:57.176Z",
    "dateUpdated": "2026-09-02T12:49:28.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3bce44b344040e5eef3d64d38b157c15304c0aab",
              "status": "affected",
              "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80",
              "versionType": "git"
            },
            {
              "lessThan": "5017c302ca4b2a45149ad64e058fa2d5623c068f",
              "status": "affected",
              "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80",
              "versionType": "git"
            },
            {
              "lessThan": "21167bf70dbe400563e189ac632258d35eda38b5",
              "status": "affected",
              "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80",
              "versionType": "git"
            },
            {
              "lessThan": "55c0ced59fe17dee34e9dfd5f7be63cbab207758",
              "status": "affected",
              "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject negative offsets for ALU ops\n\nWhen verifying BPF programs, the check_alu_op() function validates\ninstructions with ALU operations. The \u0027offset\u0027 field in these\ninstructions is a signed 16-bit integer.\n\nThe existing check \u0027insn-\u003eoff \u003e 1\u0027 was intended to ensure the offset is\neither 0, or 1 for BPF_MOD/BPF_DIV. However, because \u0027insn-\u003eoff\u0027 is\nsigned, this check incorrectly accepts all negative values (e.g., -1).\n\nThis commit tightens the validation by changing the condition to\n\u0027(insn-\u003eoff != 0 \u0026\u0026 insn-\u003eoff != 1)\u0027. This ensures that any value\nother than the explicitly permitted 0 and 1 is rejected, hardening the\nverifier against malformed BPF programs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the local `bpf(BPF_PROG_LOAD)` syscall, which invokes `bpf_check()` \u2192 `do_check()` \u2192 `check_alu_op()`. Although the resulting program later executes on packet receive, loading the malformed instruction requires local system access.\nAC:L - Exploitation is fully deterministic: emit a `BPF_DIV`/`BPF_MOD` instruction with `off = -1`, set the dividend to `LLONG_MIN` and the divisor to `-1`, and run it. There is no race, no timing window, and no dependence on memory layout or system state the attacker cannot control.\nPR:L - `sysctl_unprivileged_bpf_disabled` defaults to 0 unless `CONFIG_BPF_UNPRIV_DEFAULT_OFF` is built in (Android and many embedded/distro configs leave it enabled), and `kernel/bpf/syscall.c:2941` explicitly permits `BPF_PROG_TYPE_SOCKET_FILTER` and `BPF_PROG_TYPE_CGROUP_SKB` loads with no `bpf_cap`; the program is then triggered via `SO_ATTACH_BPF` on the attacker\u0027s own socket. Where unprivileged BPF is disabled, `bpf_token_capable()` grants `ns_capable()`-level CAP_BPF inside a delegated user namespace, so real root is never required.\nUI:N - The attacker loads and triggers the BPF program entirely on their own, by attaching it to a socket they own and sending themselves a packet. No victim action of any kind is involved.\nS:U - The verifier bypass, the JIT\u0027d signed division, and the resulting fault all occur within the kernel\u0027s own security authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - On the s390 JIT the `switch (off)` in the DIV/MOD handlers has no default, so no divide instruction is emitted while the trailing `lgr %dst,%rc` still executes, copying the uninitialized kernel scratch register `%r0`/`%r1` \u2014 potentially a kernel pointer \u2014 into a BPF register that the program can write to a map and read from userspace, repeatably and at attacker-chosen program points. The x86 divide-error oops additionally dumps full register and stack state, defeating KASLR.\nI:H - The verifier accepts an instruction whose runtime semantics it never models \u2014 the JIT executes a signed division while the fixup layer applies only the unsigned guards, and on s390 uncontrolled kernel register contents are injected into verified program state. This is a verifier validation bypass in which JIT-emitted code and the verifier\u0027s model of that code diverge, so integrity of the sandbox\u0027s guarantees is not preserved.\nA:H - Because `is_sdiv`/`is_smod` in `do_misc_fixups()` test `insn-\u003eoff == 1`, the `LLONG_MIN sdiv -1` overflow guards are skipped while the x86-64 JIT still emits `cqo; idiv`, producing a #DE with no exception-table entry \u2014 `do_trap()` reaches `die(\"divide error\")`, oopsing the kernel. Triggered from a socket-filter/tc/XDP program this fires in softirq context, yielding \"Fatal exception in interrupt\" and a full system panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:14.652Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3bce44b344040e5eef3d64d38b157c15304c0aab"
        },
        {
          "url": "https://git.kernel.org/stable/c/5017c302ca4b2a45149ad64e058fa2d5623c068f"
        },
        {
          "url": "https://git.kernel.org/stable/c/21167bf70dbe400563e189ac632258d35eda38b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/55c0ced59fe17dee34e9dfd5f7be63cbab207758"
        }
      ],
      "title": "bpf: Reject negative offsets for ALU ops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40169",
    "datePublished": "2025-11-12T10:46:51.736Z",
    "dateReserved": "2025-04-16T07:20:57.176Z",
    "dateUpdated": "2026-08-05T12:08:14.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/fc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11269c08013f4ee8b8f5edc6c56700acb34092d0",
              "status": "affected",
              "version": "5e0bc09a52b6169ce90f7ac6e195791adb16cec4",
              "versionType": "git"
            },
            {
              "lessThan": "a28112cc55013cd8cbd5d36b5115a5b851151bd9",
              "status": "affected",
              "version": "9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8",
              "versionType": "git"
            },
            {
              "lessThan": "060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c",
              "status": "affected",
              "version": "eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30",
              "versionType": "git"
            },
            {
              "lessThan": "7331925c247b03b7767b8cd93cfe1b7aa2377850",
              "status": "affected",
              "version": "710c69dbaccdac312e32931abcb8499c1525d397",
              "versionType": "git"
            },
            {
              "lessThan": "7a619f8c869117ffed08365b377f66b7e1d941b4",
              "status": "affected",
              "version": "710c69dbaccdac312e32931abcb8499c1525d397",
              "versionType": "git"
            },
            {
              "lessThan": "db5a5406fb7e5337a074385c7a3e53c77f2c1bd3",
              "status": "affected",
              "version": "710c69dbaccdac312e32931abcb8499c1525d397",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1d86f79287206deec36d63b89c741cf542b6cadd",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.195",
              "status": "affected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.156",
              "status": "affected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.112",
              "status": "affected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/fc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "5.15.150",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "6.1.80",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "6.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: move lsop put work to nvmet_fc_ls_req_op\n\nIt\u2019s possible for more than one async command to be in flight from\n__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.\n\nIn the current code, only one put work item is queued at a time, which\nresults in a leaked reference.\n\nTo fix this, move the work item to the nvmet_fc_ls_req_op struct, which\nalready tracks all resources related to the command."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The trigger is a remote FC-NVMe initiator sending Create Association / Disconnect Association Link Services to the nvmet-fc target port, processed via `nvmet_fc_rcv_ls_req()` from the LLDD (lpfc). Consistent with other NVMe-oF target CVEs in this tree (including qla2xxx FC), the attacker is a remote peer on the storage fabric, which can itself be extended over routed transports.\nAC:L - The attacker controls both sides of the timing \u2014 issuing several associations and then disconnecting them concurrently reliably puts multiple LS requests in flight, and `queue_work()` deterministically drops every put after the first while one is pending. No memory-layout or victim-state condition is involved.\nPR:N - `nvmet_fc_ls_create_association()` and `nvmet_fc_ls_disconnect()` validate only LS descriptor lengths and tags; there is no host-NQN allow-list check, NVMe Connect, or authentication on this path. Any initiator that can reach the target port exercises it pre-authentication.\nUI:N - The leak is produced entirely by attacker-sent Link Service frames handled asynchronously by the target. No administrator or local user action is required.\nS:U - The leaked reference, stranded allocation, and failed teardown are all confined to the kernel of the target host. No security authority boundary such as a VM or IOMMU domain is crossed.\nC:N - The defect is purely a missed `kref_put()`; nothing is freed early, read out of bounds, or returned to the attacker. Tracing the coalescing shows it can only drop puts, never duplicate them, so no use-after-free read primitive exists.\nI:N - No memory is corrupted or written out of bounds \u2014 the refcount only ever ends too high, so no write or control-flow-hijack primitive arises. lpfc additionally guards its on-stack completion in `lpfc_nvmet_targetport_delete()`, closing the only late-completion write hazard.\nA:H - The tgtport is never freed, so `nvmet_fc_free_ls_iodlist()` and `targetport_delete` never run: `lpfc_nvmet_destroy_targetport()` stalls for `LPFC_NVMET_WAIT_TMO` (5 s) and then aborts with an error, permanently stranding the target port, its HBA DMA mappings, and a `get_device()` reference that no longer can be released without a reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:16.789Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11269c08013f4ee8b8f5edc6c56700acb34092d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a28112cc55013cd8cbd5d36b5115a5b851151bd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7331925c247b03b7767b8cd93cfe1b7aa2377850"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a619f8c869117ffed08365b377f66b7e1d941b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/db5a5406fb7e5337a074385c7a3e53c77f2c1bd3"
        }
      ],
      "title": "nvmet-fc: move lsop put work to nvmet_fc_ls_req_op",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40171",
    "datePublished": "2025-11-12T10:46:52.289Z",
    "dateReserved": "2025-04-16T07:20:57.176Z",
    "dateUpdated": "2026-08-05T12:08:16.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/qaic/qaic_control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48b1d42286bfef7628b1d6c8c28d4e456c90f725",
              "status": "affected",
              "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
              "versionType": "git"
            },
            {
              "lessThan": "551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede",
              "status": "affected",
              "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
              "versionType": "git"
            },
            {
              "lessThan": "1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6",
              "status": "affected",
              "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
              "versionType": "git"
            },
            {
              "lessThan": "11f08c30a3e4157305ba692f1d44cca5fc9a8fca",
              "status": "affected",
              "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3",
              "versionType": "git"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/qaic/qaic_control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()\n\nCurrently, if find_and_map_user_pages() takes a DMA xfer request from the\nuser with a length field set to 0, or in a rare case, the host receives\nQAIC_TRANS_DMA_XFER_CONT from the device where resources-\u003exferred_dma_size\nis equal to the requested transaction size, the function will return 0\nbefore allocating an sgt or setting the fields of the dma_xfer struct.\nIn that case, encode_addr_size_pairs() will try to access the sgt which\nwill lead to a general protection fault.\n\nReturn an EINVAL in case the user provides a zero-sized ALP, or the device\nrequests continuation after all of the bytes have been transferred."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the DRM_IOCTL_QAIC_MANAGE ioctl on the local accel character device /dev/accel/accelN, requiring local system access. There is no network-facing path into qaic_manage_ioctl().\nAC:L - A single ioctl carrying a QAIC_TRANS_DMA_XFER_FROM_USR transaction with the user-controlled size field set to 0 deterministically makes find_and_map_user_pages() return 0 with xfer-\u003esgt/page_list/nr_pages uninitialized; no race and no attacker-independent condition is involved. Grooming the kmalloc-64 slab so the stale sgt is a usable pointer is fully under attacker control via a preceding legitimate DMA xfer.\nPR:L - The QAIC_MANAGE ioctl is registered with flags 0 \u2014 no DRM_ROOT_ONLY, no CAP_SYS_ADMIN, and no DRM_AUTH check \u2014 so any unprivileged process able to open the accel node (the normal case for inference/compute workloads and containers on AIC100 hosts) can trigger it. No capability is verified anywhere along encode_message() \u2192 encode_dma() \u2192 find_and_map_user_pages().\nUI:N - The attacker issues the ioctl directly from their own process; no victim action, mount, or file open is needed.\nS:U - The uninitialized-pointer use and resulting corruption occur within the kernel\u0027s own security authority, the same authority the attacker escalates into. No VM, IOMMU, or sandbox boundary is crossed as a required part of the impact.\nC:H - Using uninitialized heap memory as a struct sg_table pointer causes reads of arbitrary kernel memory via sgt-\u003enents and the sg walk, and those harvested sg_dma_address/sg_dma_len values are encoded into the message sent to the accelerator, disclosing kernel-controlled DMA addresses off-host to the device. The resulting stale-pointer/double-free state is a general heap corruption primitive leveragable for arbitrary read.\nI:H - free_dma_xfers() unconditionally performs dma_unmap_sgtable(), sg_free_table(), kfree() on the uninitialized sgt and put_page()/kfree() over the uninitialized page_list and nr_pages, yielding arbitrary/double free and page refcount underflow on attacker-groomed pointers. Combined with feeding attacker-influenced addresses to the device\u0027s DMA engine, this is exploitable for arbitrary write and control-flow hijack.\nA:H - The commit itself documents that encode_addr_size_pairs() dereferences the unset sgt and produces a general protection fault, i.e. a kernel oops/panic, and it is triggerable repeatedly by any local user with device access. The double-free and page refcount corruption paths cause further fatal kernel faults."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:17.861Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48b1d42286bfef7628b1d6c8c28d4e456c90f725"
        },
        {
          "url": "https://git.kernel.org/stable/c/551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/11f08c30a3e4157305ba692f1d44cca5fc9a8fca"
        }
      ],
      "title": "accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40172",
    "datePublished": "2025-11-12T10:53:49.245Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-08-05T12:08:17.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_tunnels.h",
            "net/ipv4/ip_tunnel.c",
            "net/ipv6/ip6_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "566f8d5c8a443f2dd69c5460fdec43ed1c870c65",
              "status": "affected",
              "version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
              "versionType": "git"
            },
            {
              "lessThan": "11f6066af3bfb8149aa16c42c0b0c5ea5b199a94",
              "status": "affected",
              "version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
              "versionType": "git"
            },
            {
              "lessThan": "402b6985e872b4cf394bbbf33b503947a326a6cb",
              "status": "affected",
              "version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
              "versionType": "git"
            },
            {
              "lessThan": "10fe967efe73c610e526ff7460581610633dee9c",
              "status": "affected",
              "version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
              "versionType": "git"
            },
            {
              "lessThan": "48294a67863c9cfa367abb66bbf0ef6548ae124f",
              "status": "affected",
              "version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
              "versionType": "git"
            },
            {
              "lessThan": "eeb4345488672584db4f8c20a1ae13a212ce31c4",
              "status": "affected",
              "version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
              "versionType": "git"
            },
            {
              "lessThan": "b6eb25d870f1a8ae571fd3da2244b71df547824b",
              "status": "affected",
              "version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
              "versionType": "git"
            },
            {
              "lessThan": "21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16",
              "status": "affected",
              "version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_tunnels.h",
            "net/ipv4/ip_tunnel.c",
            "net/ipv6/ip6_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.196",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ip6_tunnel: Prevent perpetual tunnel growth\n\nSimilarly to ipv4 tunnel, ipv6 version updates dev-\u003eneeded_headroom, too.\nWhile ipv4 tunnel headroom adjustment growth was limited in\ncommit 5ae1e9922bbd (\"net: ip_tunnel: prevent perpetual headroom growth\"),\nipv6 tunnel yet increases the headroom without any ceiling.\n\nReflect ipv4 tunnel headroom adjustment limit on ipv6 version.\n\nCredits to Francesco Ruggeri, who was originally debugging this issue\nand wrote local Arista-specific patch and a reproducer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The unbounded growth is driven by the local transmit path (`ip6_tnl_xmit`) and requires the attacker to establish a two-tunnel routing loop and then push packets into it, which is done via netlink/socket operations on the local system. A purely remote attacker cannot create the required tunnel topology, so the reliable, fully attacker-controlled path is local.\nAC:L - The attacker controls every precondition \u2014 tunnel creation, the looping routes, and the packet stream \u2014 and each transmitted packet deterministically increments `dev-\u003eneeded_headroom` until the u16 header offset wraps; no race, memory-layout luck, or victim state is involved.\nPR:L - Configuring ip6tnl/ip6gre devices and routes needs CAP_NET_ADMIN, but an unprivileged user gains that in their own network namespace with `unshare -Urn`, and the resulting heap corruption is not confined to that namespace.\nUI:N - The attacker creates the tunnels and generates the traffic itself; no action by any other user or administrator is required.\nS:U - The corruption occurs in kernel memory within the same security authority; there is no VM, IOMMU, or hypervisor boundary crossed, making this standard in-kernel privilege escalation.\nC:H - Once `network_header` wraps, `skb-\u003edata` points outside `skb-\u003ehead`, producing out-of-bounds/use-after-free reads \u2014 the IPv4 twin of this bug was reported as a KASAN use-after-free read in `__skb_flow_dissect`, and such reads can disclose arbitrary adjacent kernel heap contents.\nI:H - After the negative `__skb_pull`, `dev_hard_header()` pushes and writes an L2 header at the out-of-bounds `skb-\u003edata`, giving an out-of-bounds write into unrelated kernel heap memory that can be leveraged for control-flow hijacking.\nA:H - The wrapped offsets and out-of-bounds accesses reliably produce kernel oops/panic, and the runaway headroom also forces ever-larger skb head reallocations, exhausting memory and destabilizing the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:18.915Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/566f8d5c8a443f2dd69c5460fdec43ed1c870c65"
        },
        {
          "url": "https://git.kernel.org/stable/c/11f6066af3bfb8149aa16c42c0b0c5ea5b199a94"
        },
        {
          "url": "https://git.kernel.org/stable/c/402b6985e872b4cf394bbbf33b503947a326a6cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/10fe967efe73c610e526ff7460581610633dee9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/48294a67863c9cfa367abb66bbf0ef6548ae124f"
        },
        {
          "url": "https://git.kernel.org/stable/c/eeb4345488672584db4f8c20a1ae13a212ce31c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6eb25d870f1a8ae571fd3da2244b71df547824b"
        },
        {
          "url": "https://git.kernel.org/stable/c/21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16"
        }
      ],
      "title": "net/ip6_tunnel: Prevent perpetual tunnel growth",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40173",
    "datePublished": "2025-11-12T10:53:49.571Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-08-05T12:08:18.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9f83fd0c179e0f458e824e417f9d5ad53443f685",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "c61d4368197d65c4809d9271f3b85325a600586a",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "39dec4ea3daf77f684308576baf483b55ca7f160",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "4fc109d0ab196bd943b7451276690fb6bb48c2e0",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "b8a6ff84abbcbbc445463de58704686011edc8e1",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: wait for pending async decryptions if tls_strp_msg_hold fails\n\nAsync decryption calls tls_strp_msg_hold to create a clone of the\ninput skb to hold references to the memory it uses. If we fail to\nallocate that clone, proceeding with async decryption can lead to\nvarious issues (UAF on the skb, writing into userspace memory after\nthe recv() call has returned).\n\nIn this case, wait for all pending decryption requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the kTLS software receive path (net/tls/tls_sw.c) processing TLS records supplied by the remote peer, with the record stream, sizes and record types fully controlled by that peer. Per kernel scoring guidance, kTLS bugs triggered by remote TLS peer data are Network.\nAC:L - Once the skb_clone()/alloc_skb() allocation fails, the outcome is deterministic, and a remote peer can drive the memory pressure that induces it by opening many connections and queueing large record backlogs (trivially so under memcg-constrained containers). The remaining conditions \u2014 TLS 1.2 plus an async-capable AEAD \u2014 are the default on affected stable kernels since x86 AES-NI GCM registers through the SIMD wrapper with CRYPTO_ALG_ASYNC.\nPR:N - The attacker is the remote TLS peer of an already-established kTLS connection and needs no privileges or account on the target system. The vulnerable code runs as part of normal server-side record processing.\nUI:N - No victim action beyond the server\u0027s ordinary recv()/recvmsg() loop, which runs automatically as part of serving the connection. No configuration change, file open, or mount is required.\nS:U - The corruption is confined to kernel memory and the receiving process\u0027s own address space within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The live strparser anchor skb is queued on async_hold and later freed by __skb_queue_purge() while strp-\u003eanchor still references it, giving a use-after-free on an skbuff that an attacker can reclaim with sprayed network data; the in-flight AEAD also reads input skb memory whose references were dropped. Per guidance, use-after-free is High.\nI:H - The UAF/double-free on the anchor skb yields a heap write primitive after slab reclaim, and the crypto engine additionally writes attacker-chosen plaintext into the pinned user pages after recv() has already returned, corrupting whatever the application has since placed in that buffer. Per guidance, use-after-free is High.\nA:H - The freed anchor skb remains reachable from softirq context via tls_strp_data_ready and is freed a second time by tls_strp_anchor_free() on close, causing oops/panic or slab corruption. Any use-after-free or double-free is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:21.202Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9f83fd0c179e0f458e824e417f9d5ad53443f685"
        },
        {
          "url": "https://git.kernel.org/stable/c/c61d4368197d65c4809d9271f3b85325a600586a"
        },
        {
          "url": "https://git.kernel.org/stable/c/39dec4ea3daf77f684308576baf483b55ca7f160"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fc109d0ab196bd943b7451276690fb6bb48c2e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8a6ff84abbcbbc445463de58704686011edc8e1"
        }
      ],
      "title": "tls: wait for pending async decryptions if tls_strp_msg_hold fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40176",
    "datePublished": "2025-11-12T10:53:50.443Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-08-05T12:08:21.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/zynqmp-ipi-mailbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cd0cbf2713f6e027ebba867cb7409ae345a31312",
              "status": "affected",
              "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79",
              "versionType": "git"
            },
            {
              "lessThan": "ab96f08ecedd263ecaab9df8455bfb23b07fdcc2",
              "status": "affected",
              "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79",
              "versionType": "git"
            },
            {
              "lessThan": "0aead8197fc1a85b0a89646e418feb49a564b029",
              "status": "affected",
              "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/zynqmp-ipi-mailbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop\n\nThe cleanup loop was starting at the wrong array index, causing\nout-of-bounds access.\nStart the loop at the correct index for zero-indexed arrays to prevent\naccessing memory beyond the allocated array bounds."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:44:18.565Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cd0cbf2713f6e027ebba867cb7409ae345a31312"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab96f08ecedd263ecaab9df8455bfb23b07fdcc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aead8197fc1a85b0a89646e418feb49a564b029"
        }
      ],
      "title": "mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40180",
    "datePublished": "2025-11-12T21:56:25.395Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-05-11T21:44:18.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3fba965a9aac0fa3cbd8138436a37af9ab466d79",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "057764172fcc6ee2ccb6c41351a55a9f054dc8fd",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "2e67c2037382abb56497bb9d7b7e10be04eb5598",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "b6bfe44b6dbb14a31d86c475cdc9c7689534fb09",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "f36a305d30f557306d87c787ddffe094ac5dac89",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "7404ce888a45eb7da0508b7cbbe6f2e95302eeb8",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "23f3770e1a53e6c7a553135011f547209e141e72",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.157",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.113",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}\n\nCilium has a BPF egress gateway feature which forces outgoing K8s Pod\ntraffic to pass through dedicated egress gateways which then SNAT the\ntraffic in order to interact with stable IPs outside the cluster.\n\nThe traffic is directed to the gateway via vxlan tunnel in collect md\nmode. A recent BPF change utilized the bpf_redirect_neigh() helper to\nforward packets after the arrival and decap on vxlan, which turned out\nover time that the kmalloc-256 slab usage in kernel was ever-increasing.\n\nThe issue was that vxlan allocates the metadata_dst object and attaches\nit through a fake dst entry to the skb. The latter was never released\nthough given bpf_redirect_neigh() was merely setting the new dst entry\nvia skb_dst_set() without dropping an existing one first."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The leak is in the net/core/filter.c datapath and is driven entirely by received packets \u2014 unauthenticated VXLAN/UDP frames decapsulated by a collect-md tunnel attach the metadata_dst that is subsequently orphaned by bpf_redirect_neigh(). A remote sender anywhere on the network can drive the leak at will.\nAC:L - Every packet traversing the tc-BPF redirect path leaks deterministically \u2014 no race, no memory-layout dependence, no timing window. Cilium\u0027s egress-gateway configuration that exposes this is a mainstream, widely deployed Kubernetes setup, and once present the trigger is 100% reliable.\nPR:N - VXLAN collect-md decapsulation performs no authentication of the encapsulated traffic, so the attacker needs no credentials or account on the target \u2014 merely the ability to send packets that transit the gateway. The privileged operation (loading the tc BPF program) is performed by the administrator, not the attacker.\nUI:N - The leak occurs entirely within kernel packet processing on the receive path; no local user or administrator has to take any action for the attacker\u0027s packets to be processed.\nS:U - The orphaned dst objects and pinned netdev references stay within the kernel\u0027s own resource domain on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The metadata_dst is simply never freed \u2014 it is not reused, re-read, or exposed to the attacker, and no out-of-bounds or uninitialized memory is accessed. No information is disclosed.\nI:N - There is no memory corruption, overwrite, or type confusion; the only effect is that a reference is never released, so no kernel or user data is modified.\nA:H - The leak is unbounded and attacker-paced \u2014 256 bytes of kmalloc-256 per redirected packet with no upper limit, so sustained traffic exhausts kernel memory and drives the node into OOM/panic. On paths carrying a real route dst, the leaked reference also pins net_devices, hanging network-namespace teardown indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:23.502Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3fba965a9aac0fa3cbd8138436a37af9ab466d79"
        },
        {
          "url": "https://git.kernel.org/stable/c/057764172fcc6ee2ccb6c41351a55a9f054dc8fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e67c2037382abb56497bb9d7b7e10be04eb5598"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6bfe44b6dbb14a31d86c475cdc9c7689534fb09"
        },
        {
          "url": "https://git.kernel.org/stable/c/f36a305d30f557306d87c787ddffe094ac5dac89"
        },
        {
          "url": "https://git.kernel.org/stable/c/7404ce888a45eb7da0508b7cbbe6f2e95302eeb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/23f3770e1a53e6c7a553135011f547209e141e72"
        }
      ],
      "title": "bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40183",
    "datePublished": "2025-11-12T21:56:27.429Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-08-05T12:08:23.502Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}