Skip to main content

Linux Kernel CVE-2025-40291

| EUVDEUVD-2025-201653 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local unprivileged io_uring access (AV:L/PR:L) with no interaction triggers kernel heap corruption enabling full host compromise, so C:H/I:H/A:H; scope unchanged within the kernel.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch available
Apr 16, 2026 - 05:29 EUVD
826ce37a842633efe1bb763e4b13045d74060d72,146eb58629f45f8297e83d69e64d4eea4b28d972
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201653
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix regbuf vector size truncation

There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflow "int"s used later. Rough but simple, can be improved on top.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's io_uring subsystem arises from an integer truncation flaw in io_estimate_bvec_size(), where the calculated number of registered-buffer segments is truncated into an int and can overflow values used in later allocation and copy logic. Affected are Linux kernel builds carrying the vulnerable io_uring registered buffer vector code (6.15 through the fixed 6.17.8/6.18 line); a local user able to submit io_uring operations can trigger heap corruption with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with a bug reported and fixed upstream rather than one under active exploitation.

Technical ContextAI

io_uring is the Linux asynchronous I/O interface that lets user space submit batched operations via shared submission/completion rings. This vulnerability lives in the registered-buffer (regbuf) path, specifically io_estimate_bvec_size(), which computes how many bio_vec (bvec) segments a registered buffer vector requires. The computed segment count is truncated to a signed int and is not checked against int overflow before being consumed by downstream size and allocation math. The root cause class is integer truncation/overflow leading to an undersized allocation or out-of-bounds handling - effectively a buffer overflow (as the input tags confirm), a classic CWE-190/CWE-681-style arithmetic error feeding a CWE-787 out-of-bounds write, even though the CWE field is formally N/A in the source data.

RemediationAI

Vendor-released patch: update to Linux 6.17.8 or 6.18 (or a distribution kernel that backports fix commits 826ce37a842633efe1bb763e4b13045d74060d72 / 146eb58629f45f8297e83d69e64d4eea4b28d972), as referenced at https://git.kernel.org/stable/c/826ce37a842633efe1bb763e4b13045d74060d72 and https://git.kernel.org/stable/c/146eb58629f45f8297e83d69e64d4eea4b28d972. Apply your distribution's corresponding kernel security update and reboot. Where immediate patching is not possible, the primary compensating control is to restrict io_uring exposure: set the sysctl kernel.io_uring_disabled=2 to disable io_uring for unprivileged users system-wide (trade-off: applications relying on io_uring lose that acceleration and may fall back to slower syscalls or fail), or confine untrusted workloads with seccomp profiles that block io_uring_setup/io_uring_register (as done by default in newer Docker/containerd profiles). Limiting local shell access and untrusted code execution on affected hosts also reduces reachability of the local attack vector.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40291 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy