Skip to main content

Linux Kernel CVE-2025-40358

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
4.4 MEDIUM

Local low-priv trigger of foreign-task unwinding with no UI; impact is a bounded out-of-bounds read giving minor info exposure (C:L) and possible KASAN warning/instability (A:L), no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 08:14 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.1 (HIGH)
Patch released
Mar 25, 2026 - 19:32 nvd
Patch available
Analysis Generated
Mar 25, 2026 - 11:22 vuln.today
CVE Published
Dec 16, 2025 - 14:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

riscv: stacktrace: Disable KASAN checks for non-current tasks

Unwinding the stack of a task other than current, KASAN would report "BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460"

There is a same issue on x86 and has been resolved by the commit 84936118bdf3 ("x86/unwind: Disable KASAN checks for non-current tasks") The solution could be applied to RISC-V too.

This patch also can solve the issue: https://seclists.org/oss-sec/2025/q4/23

[pjw@kernel.org: clean up checkpatch issues]

AnalysisAI

Out-of-bounds memory access in the RISC-V stack unwinder (walk_stackframe) of the Linux kernel lets KASAN trip and read past a task's kernel stack boundary when unwinding a task other than the current one. The defect mirrors a previously fixed x86 issue (commit 84936118bdf3) and is reached through normal task-introspection paths on RISC-V builds. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 7th percentile), and it is not in CISA KEV; the fix disables KASAN checks for non-current tasks.

Technical ContextAI

The flaw is in RISC-V architecture-specific stacktrace code (arch/riscv, walk_stackframe), which walks frame pointers to reconstruct a call chain. When the kernel unwinds a task that is not currently running - via /proc/<pid>/stack, sysrq, or scheduler/trace paths - the frame-pointer walk can dereference memory just outside the target task's stack region. With KASAN (Kernel Address Sanitizer) compiled in, that shadow-checked read is flagged as 'out-of-bounds in walk_stackframe'. The root-cause class is an out-of-bounds read (CWE-125); no CWE was supplied in the input. The fix follows the established x86 pattern of suppressing KASAN validation while unwinding a foreign task, since the unwinder may legitimately probe boundary words.

Affected ProductsAI

The Linux kernel is affected, specifically builds for the RISC-V architecture that include the stacktrace/unwinder code; the defect and its fix are architecture-specific and do not affect x86 (already patched). Exact vulnerable ranges are defined by stable-tree commits rather than one tag: fixes were backported across multiple branches (git.kernel.org commits 060ea84a484e, 27379fcc15a1, 2c8d2b53866f, ef4d626ac59a, f34ba22989da). Distribution exposure is confirmed for Ubuntu, which shipped kernel updates under USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1). No CPE strings were provided, so precise version boundaries should be read from the referenced commits and distro advisories.

RemediationAI

Patch available per vendor advisory: apply the upstream stable-tree fix that disables KASAN checks for non-current tasks in the RISC-V unwinder (git.kernel.org commits 060ea84a484e, 27379fcc15a1, 2c8d2b53866f, ef4d626ac59a, f34ba22989da), or install your distribution's updated kernel - Ubuntu users should apply the packages in USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and reboot into the new kernel. Because the fix is a source-level unwinder change there is no runtime toggle; as an interim compensating control on RISC-V hosts you can restrict local access to introspection surfaces that force foreign-task unwinding, for example tightening permissions on /proc/<pid>/stack and disabling the sysrq stack-dump trigger via /proc/sys/kernel/sysrq, accepting that these limit legitimate debugging and observability. Disabling KASAN is not recommended, as KASAN is a hardening feature, not the vulnerability.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40358 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy