CVE-2025-40159

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40159", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.176Z", "datePublished": "2025-11-12T10:24:36.104Z", "dateUpdated": "2026-10-15T22:02:39.041Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:09.151Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Harden userspace-supplied xdp_desc validation\n\nTurned out certain clearly invalid values passed in xdp_desc from\nuserspace can pass xp_{,un}aligned_validate_desc() and then lead\nto UBs or just invalid frames to be queued for xmit.\n\ndesc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len\ncan cause positive integer overflow and wraparound, the same way low\nenough desc->addr with a non-zero pool->tx_metadata_len can cause\nnegative integer overflow. Both scenarios can then pass the\nvalidation successfully.\nThis doesn't happen with valid XSk applications, but can be used\nto perform attacks.\n\nAlways promote desc->len to ``u64`` first to exclude positive\noverflows of it. Use explicit check_{add,sub}_overflow() when\nvalidating desc->addr (which is ``u64`` already).\n\nbloat-o-meter reports a little growth of the code size:\n\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)\nFunction old new delta\nxskq_cons_peek_desc 299 330 +31\nxsk_tx_peek_release_desc_batch 973 1002 +29\nxsk_generic_xmit 3148 3132 -16\n\nbut hopefully this doesn't hurt the performance much."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malicious xdp_desc values are written by a local process into its own mmap'd AF_XDP TX ring and triggered via sendto()/sendmsg(); this is a local syscall interface, not remote network data processing.\nAC:L - The attacker fully controls desc->addr, desc->len, desc->options, and pool->tx_metadata_len, so the overflow is triggered deterministically with no race or external condition.\nPR:L - AF_XDP socket creation only requires CAP_NET_RAW in the socket's user namespace, which an unprivileged user obtains via `unshare -Urn`; no real root is needed.\nUI:N - The attacking process performs socket setup, descriptor crafting, and transmission entirely on its own; no other user's interaction is required.\nS:U - The overflow corrupts kernel memory within the same kernel security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The bypassed length validation causes an out-of-bounds read of up to ~4GB from kernel memory adjacent to the umem buffer, which is copied into transmitted skb data \u2014 an arbitrary kernel memory disclosure primitive.\nI:H - The invalid len/addr drive get_page() on arbitrary \"struct page\" pointers past the pages array and queue corrupted frames, providing a heap/memory-corruption primitive exploitable beyond a mere crash.\nA:H - Out-of-bounds access to the pages array and refcounting of garbage pointers reliably oops/panics the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/xdp/xsk_queue.h"], "versions": [{"version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899", "lessThan": "1463cd066f32efd56ddfd3ac4e3524200f362980", "status": "affected", "versionType": "git"}, {"version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899", "lessThan": "5b5fffa7c81e55d8c8edf05ad40d811ec7047e21", "status": "affected", "versionType": "git"}, {"version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899", "lessThan": "07ca98f906a403637fc5e513a872a50ef1247f3b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/xdp/xsk_queue.h"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.54", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.4", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.17.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1463cd066f32efd56ddfd3ac4e3524200f362980"}, {"url": "https://git.kernel.org/stable/c/5b5fffa7c81e55d8c8edf05ad40d811ec7047e21"}, {"url": "https://git.kernel.org/stable/c/07ca98f906a403637fc5e513a872a50ef1247f3b"}], "title": "xsk: Harden userspace-supplied xdp_desc validation", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40159", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:23.652232Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:39.041Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40159", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:23.652232Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:57:24.331Z"}}], "cna": {"title": "xsk: Harden userspace-supplied xdp_desc validation", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The malicious xdp_desc values are written by a local process into its own mmap'd AF_XDP TX ring and triggered via sendto()/sendmsg(); this is a local syscall interface, not remote network data processing.\nAC:L - The attacker fully controls desc->addr, desc->len, desc->options, and pool->tx_metadata_len, so the overflow is triggered deterministically with no race or external condition.\nPR:L - AF_XDP socket creation only requires CAP_NET_RAW in the socket's user namespace, which an unprivileged user obtains via `unshare -Urn`; no real root is needed.\nUI:N - The attacking process performs socket setup, descriptor crafting, and transmission entirely on its own; no other user's interaction is required.\nS:U - The overflow corrupts kernel memory within the same kernel security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The bypassed length validation causes an out-of-bounds read of up to ~4GB from kernel memory adjacent to the umem buffer, which is copied into transmitted skb data \u2014 an arbitrary kernel memory disclosure primitive.\nI:H - The invalid len/addr drive get_page() on arbitrary \"struct page\" pointers past the pages array and queue corrupted frames, providing a heap/memory-corruption primitive exploitable beyond a mere crash.\nA:H - Out-of-bounds access to the pages array and refcounting of garbage pointers reliably oops/panics the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899", "lessThan": "1463cd066f32efd56ddfd3ac4e3524200f362980", "versionType": "git"}, {"status": "affected", "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899", "lessThan": "5b5fffa7c81e55d8c8edf05ad40d811ec7047e21", "versionType": "git"}, {"status": "affected", "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899", "lessThan": "07ca98f906a403637fc5e513a872a50ef1247f3b", "versionType": "git"}], "programFiles": ["net/xdp/xsk_queue.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.54", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.4", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/xdp/xsk_queue.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1463cd066f32efd56ddfd3ac4e3524200f362980"}, {"url": "https://git.kernel.org/stable/c/5b5fffa7c81e55d8c8edf05ad40d811ec7047e21"}, {"url": "https://git.kernel.org/stable/c/07ca98f906a403637fc5e513a872a50ef1247f3b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Harden userspace-supplied xdp_desc validation\n\nTurned out certain clearly invalid values passed in xdp_desc from\nuserspace can pass xp_{,un}aligned_validate_desc() and then lead\nto UBs or just invalid frames to be queued for xmit.\n\ndesc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len\ncan cause positive integer overflow and wraparound, the same way low\nenough desc->addr with a non-zero pool->tx_metadata_len can cause\nnegative integer overflow. Both scenarios can then pass the\nvalidation successfully.\nThis doesn't happen with valid XSk applications, but can be used\nto perform attacks.\n\nAlways promote desc->len to ``u64`` first to exclude positive\noverflows of it. Use explicit check_{add,sub}_overflow() when\nvalidating desc->addr (which is ``u64`` already).\n\nbloat-o-meter reports a little growth of the code size:\n\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)\nFunction old new delta\nxskq_cons_peek_desc 299 330 +31\nxsk_tx_peek_release_desc_batch 973 1002 +29\nxsk_generic_xmit 3148 3132 -16\n\nbut hopefully this doesn't hurt the performance much."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.54", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.4", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "6.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:09.151Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40159", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:39.041Z", "dateReserved": "2025-04-16T07:20:57.176Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-11-12T10:24:36.104Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/xdp/xsk_queue.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1463cd066f32efd56ddfd3ac4e3524200f362980", "status": "affected", "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899", "versionType": "git"}, {"lessThan": "5b5fffa7c81e55d8c8edf05ad40d811ec7047e21", "status": "affected", "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899", "versionType": "git"}, {"lessThan": "07ca98f906a403637fc5e513a872a50ef1247f3b", "status": "affected", "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/xdp/xsk_queue.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.54", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Harden userspace-supplied xdp_desc validation\n\nTurned out certain clearly invalid values passed in xdp_desc from\nuserspace can pass xp_{,un}aligned_validate_desc() and then lead\nto UBs or just invalid frames to be queued for xmit.\n\ndesc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len\ncan cause positive integer overflow and wraparound, the same way low\nenough desc->addr with a non-zero pool->tx_metadata_len can cause\nnegative integer overflow. Both scenarios can then pass the\nvalidation successfully.\nThis doesn't happen with valid XSk applications, but can be used\nto perform attacks.\n\nAlways promote desc->len to ``u64`` first to exclude positive\noverflows of it. Use explicit check_{add,sub}_overflow() when\nvalidating desc->addr (which is ``u64`` already).\n\nbloat-o-meter reports a little growth of the code size:\n\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)\nFunction old new delta\nxskq_cons_peek_desc 299 330 +31\nxsk_tx_peek_release_desc_batch 973 1002 +29\nxsk_generic_xmit 3148 3132 -16\n\nbut hopefully this doesn't hurt the performance much."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nxsk: Reforzar la validaci\u00f3n de xdp_desc suministrada por el espacio de usuario\n\nResult\u00f3 que ciertos valores claramente inv\u00e1lidos pasados en xdp_desc desde el espacio de usuario pueden pasar xp_{,un}aligned_validate_desc() y luego llevar a UBs o simplemente a que se encolen tramas inv\u00e1lidas para xmit.\n\ndesc->len cercano a U32_MAX con un pool->tx_metadata_len distinto de cero puede causar desbordamiento de entero positivo y 'wraparound', de la misma manera que un desc->addr lo suficientemente bajo con un pool->tx_metadata_len distinto de cero puede causar desbordamiento de entero negativo. Ambos escenarios pueden entonces pasar la validaci\u00f3n con \u00e9xito.\nEsto no ocurre con aplicaciones XSk v\u00e1lidas, pero puede usarse para realizar ataques.\n\nSiempre promover desc->len a u64 primero para excluir desbordamientos positivos del mismo. Usar check_{add,sub}_overflow() expl\u00edcito al validar desc->addr (que ya es u64).\n\nbloat-o-meter informa un peque\u00f1o crecimiento del tama\u00f1o del c\u00f3digo:\n\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)\nFunci\u00f3n antiguo nuevo delta\nxskq_cons_peek_desc 299 330 +31\nxsk_tx_peek_release_desc_batch 973 1002 +29\nxsk_generic_xmit 3148 3132 -16\n\npero esperemos que esto no perjudique mucho el rendimiento."}], "id": "CVE-2025-40159", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40159", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:57:23.652232Z", "version": "2.0.3"}}]}, "published": "2025-11-12T11:15:46.000", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07ca98f906a403637fc5e513a872a50ef1247f3b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1463cd066f32efd56ddfd3ac4e3524200f362980"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b5fffa7c81e55d8c8edf05ad40d811ec7047e21"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: xsk: Harden userspace-supplied xdp_desc validation", "id": "2414496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414496"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxsk: Harden userspace-supplied xdp_desc validation\nTurned out certain clearly invalid values passed in xdp_desc from\nuserspace can pass xp_{,un}aligned_validate_desc() and then lead\nto UBs or just invalid frames to be queued for xmit.\ndesc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len\ncan cause positive integer overflow and wraparound, the same way low\nenough desc->addr with a non-zero pool->tx_metadata_len can cause\nnegative integer overflow. Both scenarios can then pass the\nvalidation successfully.\nThis doesn't happen with valid XSk applications, but can be used\nto perform attacks.\nAlways promote desc->len to ``u64`` first to exclude positive\noverflows of it. Use explicit check_{add,sub}_overflow() when\nvalidating desc->addr (which is ``u64`` already).\nbloat-o-meter reports a little growth of the code size:\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)\nFunction old new delta\nxskq_cons_peek_desc 299 330 +31\nxsk_tx_peek_release_desc_batch 973 1002 +29\nxsk_generic_xmit 3148 3132 -16\nbut hopefully this doesn't hurt the performance much."], "name": "CVE-2025-40159", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40159\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40159\nhttps://lore.kernel.org/linux-cve-announce/2025111239-CVE-2025-40159-fe53@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-11-12T22:12:27.458066+00:00", "updated": "2025-11-12T22:12:27.458091+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}