Skip to main content

Linux Kernel CVE-2025-40292

| EUVDEUVD-2025-201652 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.4
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.1 MEDIUM

Trigger requires a malicious/compromised host backend (PR:H, AC:H) crossing the host-guest boundary (S:C); primary impact is guest crash (A:H) with possible limited over-read (C:L).

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.4 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201652
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 8.4
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: fix received length check in big packets

Since commit 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets"), when guest gso is off, the allocated size for big packets is not MAX_SKB_FRAGS * PAGE_SIZE anymore but depends on negotiated MTU. The number of allocated frags for big packets is stored in vi->big_packets_num_skbfrags.

Because the host announced buffer length can be malicious (e.g. the host vhost_net driver's get_rx_bufs is modified to announce incorrect length), we need a check in virtio_net receive path. Currently, the check is not adapted to the new change which can lead to NULL page pointer dereference in the below while loop when receiving length that is larger than the allocated one.

This commit fixes the received length check corresponding to the new change.

AnalysisAI

Denial-of-service (and potential out-of-bounds read) in the Linux kernel's virtio-net driver lets a malicious or compromised virtualization host crash guest VMs by announcing a receive buffer length larger than the guest allocated for 'big packets' mode. The flaw stems from an incomplete length check introduced when commit 4959aebba8c0 changed big-packet buffer sizing from a fixed MAX_SKB_FRAGS * PAGE_SIZE to an MTU-dependent value, leaving the receive-path validation stale. No public exploit has been identified at time of analysis, and EPSS is very low (0.04%), consistent with a host-to-guest condition rather than internet-facing mass exploitation.

Technical ContextAI

The affected component is the virtio-net paravirtualized network driver used by Linux guests running under KVM/QEMU/vhost_net and similar hypervisors. When guest GSO (generic segmentation offload) is disabled, 'big packets' are received into a chain of page fragments whose count is stored in vi->big_packets_num_skbfrags; since commit 4959aebba8c0 this allocation is sized from the negotiated MTU rather than a fixed MAX_SKB_FRAGS * PAGE_SIZE. The host advertises the used-buffer length via the virtio ring (vhost_net's get_rx_bufs), and the guest's receive path walks page fragments in a while loop. Because the guest's length validation was not updated to match the new MTU-based allocation, a length exceeding the allocated fragment chain drives the loop past the last populated fragment, dereferencing a NULL page pointer. The root-cause class is an improper length/bounds check (akin to CWE-20 improper input validation / CWE-476 NULL pointer dereference); the input CWE field is N/A.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18 (or later on each branch) - via the stable commits at git.kernel.org (e.g. https://git.kernel.org/stable/c/0c716703965ffc5ef4311b65cb5d84a703784717 and the sibling backports). Distribution users should apply their vendor kernel update, e.g. Ubuntu per USN-8095-1 (https://ubuntu.com/security/notices/USN-8095-1), and reboot. Where immediate patching is not possible, the exposure only matters when the hypervisor is untrusted, so the practical compensating control is to ensure guests run only on trusted, patched hosts and to restrict who can modify or run the vhost_net/host virtio backend; as a configuration workaround, enabling guest GSO offloads avoids the MTU-based big-packets allocation path (trade-off: changes offload behavior and may affect throughput and is not a guaranteed fix), so treat it as stopgap only until the kernel is updated.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40292 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy