Skip to main content

Linux Kernel CVE-2025-40112

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Local low-priv user on rare SPARC hardware must force a mid-copy fault (AC:H); primary impact is kernel crash (A:H) with possible minor info leak from wrong byte count (C:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 09:18 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 09:17 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 28, 2026 - 19:31 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara

The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations and a broken epilogue in the exception handlers. This will prevent crashes and ensure correct return values of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.

AnalysisAI

Incorrect fault-handling in the SPARC (Niagara) implementation of copy_from_user and copy_to_user in the Linux kernel causes wrong remaining-byte calculations and a broken epilogue when a user-space memory reference faults, leading to kernel crashes and incorrect return values from these core copy routines. The flaw is SPARC-architecture specific (Niagara/UltraSPARC T-series) and is fixed upstream; it is tagged as a denial-of-service issue. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 21st percentile).

Technical ContextAI

The bug lives in the SPARC-specific assembly for the kernel's uaccess primitives copy_from_user/copy_to_user on Niagara-class CPUs. A prior commit added exception handlers so that a fault on a user-space address returns from the copy routine and computes the number of bytes not copied from live register state; this patch corrects several arithmetic errors and a broken handler epilogue in that unwinding path. The affected class is essentially improper error/return-value handling in a kernel/user memory-boundary primitive (no CWE assigned by NVD). Because copy_{from,to}_user must return the exact count of bytes that could not be copied, a miscalculation can leave the kernel believing a copy succeeded when it partially faulted, or it can corrupt control flow enough to crash. The NVD references are the eight git.kernel.org stable-branch commits carrying the fix across kernel versions; distro coverage is provided by Ubuntu USN-8126-1 and USN-8125-1.

Affected ProductsAI

The Linux kernel on SPARC (Niagara / UltraSPARC T-series) architecture, in versions containing the referenced exception-handler commit up to the fixing commits. Fixed builds are distributed across the stable branches referenced at git.kernel.org (commits 05440320ea3e, 088c5098ec6d, 0b67c8fc10b1, 37547d8e6eba, 7823fc4d8ab5, 8cdeb5e482d3, a365ee556e45, a90ce516a73d). Distribution-level fixed packages are published by Ubuntu in USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1); additional tracking is at https://vuldb.com/vuln/332131. Non-SPARC architectures are not affected by this code path.

RemediationAI

Apply the vendor-released kernel update: on Ubuntu, upgrade to the fixed kernel packages per USN-8126-1 and USN-8125-1 and reboot; on other distributions, pull the stable release containing the referenced git.kernel.org fix commits (e.g. 7823fc4d8ab5 / a90ce516a73d and siblings). Because the fix is architecture-specific assembly with no runtime toggle, there is no clean feature-level workaround; the only meaningful compensating control is to limit local untrusted users on affected SPARC systems and restrict who can run code that stresses user-copy fault paths, accepting that this does not remove the defect and is only relevant on SPARC hardware. Systems on non-SPARC architectures require no action for this specific issue.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40112 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy