Skip to main content

Linux Kernel CVE-2025-40253

| EUVDEUVD-2025-201204 HIGH
2025-12-04 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 8.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Adjacent CTCM channel access (AV:A) with race-dependent double-free (AC:H); primary reliable impact is kernel crash (A:H) with only possible, uncertain memory-disclosure/corruption (C:L/I:L).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.8 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 16:35 euvd
EUVD-2025-201204
Analysis Generated
Mar 15, 2026 - 16:35 vuln.today
CVE Published
Dec 04, 2025 - 16:16 cve.org
HIGH 8.8
CVE Published
Dec 04, 2025 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/ctcm: Fix double-kfree

The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again.

Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'.

Bug detected by the clang static analyzer.

AnalysisAI

Memory corruption in the Linux kernel's s390/ctcm mainframe network driver stems from a double-kfree: mpc_rcvd_sweep_req() frees the mpcginfo structure, then ctcmpc_unpack_skb() frees the same pointer again after the conditional call returns. Discovered via clang static analysis, it affects IBM Z (s390) systems using the CTCM MPC networking driver and could lead to kernel memory corruption, denial of service, or potentially escalation when a crafted MPC sweep-request frame is processed. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.05%), and it is not listed in CISA KEV; the fix has shipped in stable kernel releases.

Technical ContextAI

The affected component is the s390 CTCM (Channel-to-Channel MPC) network device driver (drivers/s390/net/ctcm_mpc.c) used on IBM Z / s390x mainframes to provide point-to-point and Multi-Path Channel networking between logical partitions or systems. The root cause is a double-free (CWE-415): the received-frame handler ctcmpc_unpack_skb() conditionally invokes mpc_rcvd_sweep_req(mpcginfo), which frees the mpcginfo control block, but the caller then unconditionally calls kfree() on the same already-freed pointer. Freeing a heap object twice corrupts the SLUB allocator's free lists and can lead to allocator inconsistency, use-after-free primitives, or a kernel panic. The fix removes the redundant kfree() inside mpc_rcvd_sweep_req(), leaving ownership solely with the caller. NVD did not assign a CWE (listed N/A), but the defect class is unambiguously a double-free.

RemediationAI

Apply the vendor-released kernel patch by upgrading to a fixed stable release for your branch: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.118, 6.12.60, 6.17.10, or mainline 6.18 or later. Distribution users should install the corresponding packaged updates - Debian per DLA-4436-1 (https://security-tracker.debian.org/tracker/dla-4436-1) and Ubuntu per USN-8094-1/8095-1/8096-1 (https://ubuntu.com/security/notices/USN-8096-1) - and reboot into the patched kernel. Because the defect lives only in the s390 CTCM MPC path, environments not running s390 mainframes are unaffected and need no action. If patching must be deferred on an affected s390 host, a specific compensating control is to avoid loading/binding the ctcm driver (blacklist the ctcm module via modprobe) where CTC/MPC networking is not required - the trade-off is loss of channel-to-channel networking on that host; where CTCM is required, restrict which peers can establish MPC channel links so untrusted adjacent systems cannot deliver crafted sweep-request frames.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Debian

linux
Release Status Fixed Version Urgency
bullseye vulnerable 5.10.223-1 -
bullseye (security) vulnerable 5.10.251-1 -
bookworm fixed 6.1.159-1 -
bookworm (security) fixed 6.1.164-1 -
trixie fixed 6.12.63-1 -
trixie (security) fixed 6.12.74-2 -
forky fixed 6.19.6-2 -
sid fixed 6.19.8-1 -
(unstable) fixed 6.17.10-1 -
linux-6.1
Release Status Fixed Version Urgency
bullseye (security) fixed 6.1.164-1~deb11u1 -
bullseye fixed 6.1.159-1~deb11u1 -
DLA-4436-1

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.127 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.144 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.161 Affected
Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.114 Affected

Share

CVE-2025-40253 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy