Skip to main content

Linux Kernel CVE-2025-40155

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Canonical Suse
7.3
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
vuln.today AI
5.1 MEDIUM

Reading VT-d IOMMU debugfs requires root, so PR:H; local-only AV:L; primary impact is a kernel crash (A:H) with only incidental stale-memory read (C:L), no integrity impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

8
Analysis Updated
Jul 30, 2026 - 08:58 vuln.today
v4 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 08:58 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 08:57 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.3 (HIGH)
Patch released
Mar 28, 2026 - 19:30 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: debugfs: Fix legacy mode page table dump logic

In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like:

Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ...

Avoid walking the page table if TT is not 00b or 01b.

AnalysisAI

Denial of service (and potential information disclosure) in the Linux kernel's Intel VT-d IOMMU debugfs interface allows a privileged local user to crash the host by reading the domain translation dump. When a device's context entry uses a legacy-mode translation type other than 00b/01b, the SSPTPTR field is uninitialized or zero, and the debugfs code walks it as a valid page-table pointer, producing a general-protection fault on a non-canonical address. No public exploit identified at time of analysis; EPSS is negligible (0.03%) and this is not in CISA KEV.

Technical ContextAI

The affected component is the Intel VT-d (Virtualization Technology for Directed I/O) IOMMU driver's debugfs facility (iommu/vt-d), specifically domain_translation_struct_show()/pgtable_walk_level(). In VT-d legacy (scalable-mode-off) translation, each context entry carries a Translation Type (TT) field; the Second-Stage Page Table Pointer (SSPTPTR) is only architecturally meaningful when TT is 00b or 01b. For other TT values the hardware ignores SSPTPTR, so the field may hold stale or zero data. The debugfs dump logic failed to check TT before dereferencing SSPTPTR and recursively walking the page-table levels, dereferencing a garbage physical address (root cause class: use of uninitialized/invalid pointer, akin to CWE-457/CWE-824). The oops signature (pgtable_walk_level → domain_translation_struct_show → seq_read_iter) confirms the fault path originates in a userspace read of the debugfs node.

Affected ProductsAI

The Linux kernel's Intel VT-d IOMMU debugfs code is affected; the oops was reproduced on kernel 6.16.0 and the fix was backported to multiple stable branches (fix commits d8cf7b59c49f9118fa875462e18686cb6b131bb5, df2bf759a0bdb71f13e327d7527260d09facc055, and fbe6070c73badca726e4ff7877320e6c62339917 at git.kernel.org/stable). No CPE strings were provided in the input, so exact per-distro version ranges are not enumerated here; Canonical published fixed packages via Ubuntu advisories USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1). Only systems using Intel VT-d IOMMU hardware and exposing the IOMMU debugfs interface are exercisable.

RemediationAI

Patch available per vendor advisory: update the kernel to a build containing the fix (stable commits d8cf7b59c4, df2bf759a0, fbe6070c73 at git.kernel.org/stable); Ubuntu users should apply the packages in USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and reboot. No exact upstream tagged release version was provided in the input, so cite the commit hashes rather than an invented version number. As a compensating control until patched, restrict or unmount the IOMMU debugfs interface - e.g. tighten permissions on /sys/kernel/debug (mount debugfs with restrictive mode or set CONFIG_DEBUG_FS access to root-only) so unprivileged users cannot read the VT-d translation dump; the trade-off is loss of IOMMU debugging visibility for administrators and diagnostic tooling. Avoiding manual reads of the intel_iommu domain translation debugfs nodes on affected kernels also prevents the crash.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40155 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy