Skip to main content

Linux Kernel CVE-2025-40290

| EUVDEUVD-2025-201616 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Debian Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.5 MEDIUM

Local attacker with AF_XDP/CAP_NET_RAW (PR:L) low-complexity triggers a kernel panic; impact is availability only, so C:N/I:N/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201616
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xsk: avoid data corruption on cq descriptor number

Since commit 30f241fcf52a ("xsk: Fix immature cq descriptor production"), the descriptor number is stored in skb control block and xsk_cq_submit_addr_locked() relies on it to put the umem addrs onto pool's completion queue.

skb control block shouldn't be used for this purpose as after transmit xsk doesn't have control over it and other subsystems could use it. This leads to the following kernel panic due to a NULL pointer dereference.

BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 1 PID: 927 Comm: p4xsk.bin Not tainted 6.16.12+deb14-cloud-amd64 #1 PREEMPT(lazy) Debian 6.16.12-1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:xsk_destruct_skb+0xd0/0x180 [...] Call Trace: <IRQ> ? napi_complete_done+0x7a/0x1a0 ip_rcv_core+0x1bb/0x340 ip_rcv+0x30/0x1f0 __netif_receive_skb_one_core+0x85/0xa0 process_backlog+0x87/0x130 __napi_poll+0x28/0x180 net_rx_action+0x339/0x420 handle_softirqs+0xdc/0x320 ? handle_edge_irq+0x90/0x1e0 do_softirq.part.0+0x3b/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x60/0x70 __dev_direct_xmit+0x14e/0x1f0 __xsk_generic_xmit+0x482/0xb70 ? __remove_hrtimer+0x41/0xa0 ? __xsk_generic_xmit+0x51/0xb70 ? _raw_spin_unlock_irqrestore+0xe/0x40 xsk_sendmsg+0xda/0x1c0 __sys_sendto+0x1ee/0x200 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x84/0x2f0 ? __pfx_pollwake+0x10/0x10 ? __rseq_handle_notify_resume+0xad/0x4c0 ? restore_fpregs_from_fpstate+0x3c/0x90 ? switch_fpu_return+0x5b/0xe0 ? do_syscall_64+0x204/0x2f0 ? do_syscall_64+0x204/0x2f0 ? do_syscall_64+0x204/0x2f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> [...] Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: 0x1c000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)

Instead use the skb destructor_arg pointer along with pointer tagging. As pointers are always aligned to 8B, use the bottom bit to indicate whether this a single address or an allocated struct containing several addresses.

AnalysisAI

Memory corruption in the Linux kernel AF_XDP (xsk) zero-copy transmit path allows a local user with an AF_XDP socket to trigger a NULL pointer dereference and fatal kernel panic. The regression, introduced by commit 30f241fcf52a, misused the skb control block to store the completion-queue descriptor count; because the control block is reused by other subsystems (e.g. IP receive) after transmit, xsk_destruct_skb dereferences corrupted data. EPSS is 0.03% and there is no public exploit identified at time of analysis; the practical outcome is denial of service rather than the full CIA compromise implied by the raw 7.8 CVSS.

Technical ContextAI

The flaw lives in AF_XDP (XDP sockets, 'xsk'), the Linux fast-path packet interface that lets userspace TX/RX frames via a shared UMEM ring with a fill queue and a completion queue (cq). In the generic (copy-mode) xmit path, the kernel must record which UMEM addresses to return to the completion queue after the skb is freed. The buggy fix stored the descriptor number in the skb control block (skb->cb), but skb->cb is scratch space that the kernel guarantees only for the current layer - once the packet is transmitted and looped through the receive stack (__netif_receive_skb, ip_rcv), other code overwrites it, so xsk_destruct_skb reads a stale/NULL value. The corrected approach stores the address (or a pointer to an allocated multi-address struct) in skb_shinfo's destructor_arg, using bottom-bit pointer tagging (pointers are 8-byte aligned) to distinguish the single-address from the multi-address case. CWE is not assigned in the input, but the root cause is a NULL pointer dereference / use of uninitialized-or-clobbered pointer (CWE-476 class).

RemediationAI

Upgrade to a fixed kernel: the stable 6.17.x series is patched in 6.17.11, and the fix is merged for 6.18; apply your distribution's updated package - Debian users track https://bugs.debian.org/1118437 and Ubuntu users apply USN-8094-1 (https://ubuntu.com/security/notices/USN-8094-1) and reboot. The upstream fixes are commits 0ebc27a4c67d44e5ce88d21cdad8201862b78837 and c5ea2e50b5c9aa80c5b53526257540f0c26cd66d (https://git.kernel.org/stable/c/0ebc27a4c67d44e5ce88d21cdad8201862b78837). If patching must be deferred, the practical compensating control is to restrict who can open AF_XDP sockets: creating them requires CAP_NET_RAW, so drop that capability from untrusted workloads/containers, and consider setting the sysctl or seccomp policy to block the AF_XDP socket family for unprivileged processes - the trade-off is that any legitimate XDP/AF_XDP data-plane application (some high-performance networking, DPDK-style, or packet-processing services) will lose zero-copy/generic xmit functionality. Avoid running untrusted local users on hosts that require AF_XDP until patched.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40290 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy