Skip to main content

Linux Kernel CVE-2025-40204

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Remote and unauthenticated (AV:N/PR:N) but timing side-channel needs many low-jitter measurements (AC:H); primary impact is MAC forgery so I:H, with only incidental confidentiality (C:L) and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 08:21 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.1 (HIGH)
Patch released
Mar 28, 2026 - 19:31 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 22:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sctp: Fix MAC comparison to be constant-time

To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

AnalysisAI

Timing side-channel in the Linux kernel's SCTP subsystem allows remote attackers to defeat message-authentication (MAC) integrity by measuring non-constant-time byte-by-byte MAC comparisons, enabling forgery of authenticated SCTP data. The flaw affects the in-kernel SCTP implementation across multiple stable kernel series and was resolved by switching to a constant-time comparison helper. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with the high attack complexity of a practical network timing attack.

Technical ContextAI

SCTP (Stream Control Transmission Protocol, RFC 4960/RFC 4895) uses HMAC-based Message Authentication Codes to protect state cookies and the optional SCTP-AUTH extension against spoofing and blind injection. The vulnerability is an observable-timing-discrepancy class weakness (functionally CWE-208/CWE-203, though the input lists CWE as N/A): the kernel compared the received MAC against the expected MAC using a variable-time routine (e.g., memcmp), whose early-exit behavior leaks how many leading bytes matched. By measuring response-time differences an attacker can iteratively recover a valid MAC byte-by-byte. The fix replaces the comparison with a constant-time helper (crypto_memneq-style) so execution time is independent of how many bytes match. This lives entirely in the kernel's net/sctp code path; systems without the SCTP module loaded or in use are not exposed.

Affected ProductsAI

The Linux kernel's SCTP networking stack is affected across multiple maintained stable branches, as evidenced by the eight distinct git.kernel.org stable commit references (each corresponding to a different backport branch). Exact vulnerable-to-fixed version ranges are not enumerated in the provided data and must be derived from the individual stable commits. Canonical/Ubuntu has published fixed kernels via advisories USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1); distribution users should map their kernel version against those advisories.

RemediationAI

Patch available per vendor advisory: apply the upstream constant-time MAC comparison fix, delivered via the mainline/stable commits at git.kernel.org (e.g., 0b32ff285ff6, ed3044b9c810, and the six other referenced stable backports) and packaged by distributions. Ubuntu users should upgrade to the fixed kernels described in USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and reboot; other distributions ship the same fix in their kernel updates. As a compensating control where immediate patching is impossible, restrict or disable SCTP: if SCTP is not required, blacklist the module (install sctp /bin/true in modprobe.d) which fully removes exposure but breaks any SCTP-dependent applications (notably some telecom/SS7-over-IP and Diameter workloads); alternatively restrict SCTP reachability at the network layer (firewall IP protocol 132) to trusted peers, which reduces the remote attack surface without disrupting local SCTP use.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Affected

Share

CVE-2025-40204 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy