Skip to main content

Linux Kernel CVE-2025-40174

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-priv access is required (AV:L/PR:L); winning an SMP memory-ordering race is hard, so AC:H rather than AC:L, with high memory-corruption/disclosure impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.8 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 08:40 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 08:38 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Fix SMP ordering in switch_mm_irqs_off()

Stephen noted that it is possible to not have an smp_mb() between the loaded_mm store and the tlb_gen load in switch_mm(), meaning the ordering against flush_tlb_mm_range() goes out the window, and it becomes possible for switch_mm() to not observe a recent tlb_gen update and fail to flush the TLBs.

[ dhansen: merge conflict fixed by Ingo ]

AnalysisAI

Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.

Technical ContextAI

The affected component is the x86 TLB (Translation Lookaside Buffer) management path in the kernel's memory manager, specifically switch_mm_irqs_off(), the routine invoked on every context switch to change the active mm_struct (address space) and its associated CR3/PCID state. The kernel uses a per-mm tlb_gen generation counter to coordinate lazy TLB flushing: flush_tlb_mm_range() bumps tlb_gen, and a CPU switching into that mm must observe the new value to know it needs to flush. As Stephen Rothwell noted, there was no guaranteed smp_mb() between the loaded_mm store and the tlb_gen load, so on weakly-ordered SMP hardware the store and load could be reordered, breaking the happens-before relationship with flush_tlb_mm_range(). This is a memory-ordering/concurrency defect (CWE-362-class race condition, though NVD lists CWE as N/A) rather than a classic memory-safety bug, and its consequence is stale/incoherent TLB entries.

Affected ProductsAI

The Linux kernel on x86 (32/64-bit) SMP systems using the shared-mm TLB generation tracking in switch_mm_irqs_off() is affected; the flaw is in architecture-specific x86/mm code. No specific version range or CPE was provided in the intelligence data (NVD references are only stable-tree commits), so exact affected/first-fixed kernel versions must be derived from the stable trees carrying commits 0fe5e3f5fb75c5d88dad24dece3ee75e9d87adeb and 83b0177a6c4889b3a6e865da5e21b2c9d97d0551 (https://git.kernel.org/stable/c/0fe5e3f5fb75c5d88dad24dece3ee75e9d87adeb and https://git.kernel.org/stable/c/83b0177a6c4889b3a6e865da5e21b2c9d97d0551). Non-x86 architectures and single-CPU systems are not in scope for this specific ordering bug.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that includes commits 0fe5e3f5fb75c5d88dad24dece3ee75e9d87adeb and 83b0177a6c4889b3a6e865da5e21b2c9d97d0551 (https://git.kernel.org/stable/c/0fe5e3f5fb75c5d88dad24dece3ee75e9d87adeb), which restores the required smp_mb() ordering between the loaded_mm store and the tlb_gen load in switch_mm_irqs_off(). For most operators the practical path is to take the distribution vendor's next patched kernel package (Red Hat, SUSE, Ubuntu, Debian, etc.) once it ships the corresponding stable backport, then reboot to activate it. There is no meaningful configuration-level workaround for a low-level TLB ordering race; if patching must be deferred, reduce exposure by limiting untrusted local code execution on multi-tenant x86 SMP hosts (e.g., tightening container/VM tenant isolation and restricting shell access), accepting that this only lowers, not eliminates, the local attack surface.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40174 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy