Skip to main content

Linux Kernel CVE-2025-40331

HIGH
2025-12-09 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local netlink access with low privileges (AV:L/PR:L); the TOCTOU race window makes reliable triggering hard (AC:H); kernel heap corruption yields high C/I/A within an unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
4.7 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:37 vuln.today
CVE Published
Dec 09, 2025 - 16:17 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sctp: Prevent TOCTOU out-of-bounds write

For the following path not holding the sock lock,

sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()

make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use).

AnalysisAI

Local privilege-relevant out-of-bounds kernel write in the Linux kernel's SCTP subsystem lets an unprivileged local user corrupt kernel heap memory by exploiting a time-of-check/time-of-use (TOCTOU) gap in the SCTP diagnostic dump path (sctp_diag_dump → sctp_for_each_endpoint → sctp_ep_dump), which runs without holding the socket lock. Because the address list can grow between buffer allocation and the subsequent write, an attacker who races the dump against concurrent address additions can force a write past the allocated bounds, yielding potential memory corruption (CVSS 7.8, C/I/A High). There is no public exploit identified at time of analysis and EPSS is low (0.21%, 12th percentile), consistent with a race-dependent local flaw rather than a mass-exploited network bug.

Technical ContextAI

The affected component is the Linux kernel SCTP (Stream Control Transmission Protocol) implementation, specifically its integration with the sock_diag/inet_diag netlink introspection interface. When userspace requests an SCTP endpoint dump, the kernel walks all endpoints via sctp_for_each_endpoint() and serializes each endpoint's bound-address list in sctp_ep_dump(). This path does not hold the socket lock, so the number of addresses checked when the output buffer (skb) is sized can differ from the number present when the addresses are actually copied. That mismatch is a classic TOCTOU race (CWE-367) that results in an out-of-bounds write (CWE-787); the CVE feed lists the CWE as N/A but the description ('Prevent TOCTOU out-of-bounds write') and the 'Buffer Overflow' tag confirm the root-cause class. The fix bounds-checks the copy so a grown address list cannot exceed the allocated buffer.

Affected ProductsAI

The vulnerability affects the Linux kernel SCTP subsystem across multiple stable branches; the eight git.kernel.org/stable commit references indicate backports to several maintained longterm/stable series rather than a single version. No CPE strings, exact affected-version ranges, or distribution advisories were provided in the input, so precise vulnerable/fixed version boundaries per branch are not independently confirmed here. Fix commits are published upstream (e.g. https://git.kernel.org/stable/c/584307275b2048991b2e8984962189b6cc0a9b85 and the seven sibling commits under git.kernel.org/stable/c/). Only kernels with SCTP compiled/loaded and reachable via the sock_diag interface are exploitable.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor/distribution kernel update that incorporates the referenced stable commits (git.kernel.org/stable/c/584307275b2048991b2e8984962189b6cc0a9b85 and the seven related commits) as soon as your distributor ships them, since the CVE feed provides commit hashes rather than a tagged release version. Until a patched kernel is deployed, reduce attack surface by disabling or blacklisting the SCTP module where it is not required (e.g. 'install sctp /bin/true' via modprobe, or unload if not in use) - trade-off: this breaks any application or telephony/SIGTRAN workload that relies on SCTP. Alternatively, restrict access to the sock_diag/inet_diag netlink interface (for example via CAP_NET_ADMIN gating or a seccomp/LSM policy that blocks NETLINK_SOCK_DIAG for untrusted local users) - trade-off: this can break legitimate socket-monitoring tooling such as ss and diagnostic agents. These controls only matter on hosts where local untrusted users exist.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40331 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy