CVE-2025-40180

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40180", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.177Z", "datePublished": "2025-11-12T21:56:25.395Z", "dateUpdated": "2026-10-30T12:22:56.755Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:22:56.755Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop\n\nThe cleanup loop was starting at the wrong array index, causing\nout-of-bounds access.\nStart the loop at the correct index for zero-indexed arrays to prevent\naccessing memory beyond the allocated array bounds."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mailbox/zynqmp-ipi-mailbox.c"], "versions": [{"version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "lessThan": "b91951f76be14a393439c7063974b4d26f3cb64f", "status": "affected", "versionType": "git"}, {"version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "lessThan": "47a92030422d09c2de0633d23f660a65b717f008", "status": "affected", "versionType": "git"}, {"version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "lessThan": "cd0cbf2713f6e027ebba867cb7409ae345a31312", "status": "affected", "versionType": "git"}, {"version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "lessThan": "ab96f08ecedd263ecaab9df8455bfb23b07fdcc2", "status": "affected", "versionType": "git"}, {"version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "lessThan": "0aead8197fc1a85b0a89646e418feb49a564b029", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mailbox/zynqmp-ipi-mailbox.c"], "versions": [{"version": "5.1", "status": "affected"}, {"version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.54", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.4", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.12.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.17.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b91951f76be14a393439c7063974b4d26f3cb64f"}, {"url": "https://git.kernel.org/stable/c/47a92030422d09c2de0633d23f660a65b717f008"}, {"url": "https://git.kernel.org/stable/c/cd0cbf2713f6e027ebba867cb7409ae345a31312"}, {"url": "https://git.kernel.org/stable/c/ab96f08ecedd263ecaab9df8455bfb23b07fdcc2"}, {"url": "https://git.kernel.org/stable/c/0aead8197fc1a85b0a89646e418feb49a564b029"}], "title": "mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/mailbox/zynqmp-ipi-mailbox.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b91951f76be14a393439c7063974b4d26f3cb64f", "status": "affected", "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "versionType": "git"}, {"lessThan": "47a92030422d09c2de0633d23f660a65b717f008", "status": "affected", "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "versionType": "git"}, {"lessThan": "cd0cbf2713f6e027ebba867cb7409ae345a31312", "status": "affected", "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "versionType": "git"}, {"lessThan": "ab96f08ecedd263ecaab9df8455bfb23b07fdcc2", "status": "affected", "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "versionType": "git"}, {"lessThan": "0aead8197fc1a85b0a89646e418feb49a564b029", "status": "affected", "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/mailbox/zynqmp-ipi-mailbox.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.54", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop\n\nThe cleanup loop was starting at the wrong array index, causing\nout-of-bounds access.\nStart the loop at the correct index for zero-indexed arrays to prevent\naccessing memory beyond the allocated array bounds."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmailbox: zynqmp-ipi: Correcci\u00f3n de acceso fuera de l\u00edmites en el bucle de limpieza del buz\u00f3n\n\nEl bucle de limpieza estaba comenzando en el \u00edndice de array incorrecto, causando acceso fuera de l\u00edmites.\nIniciar el bucle en el \u00edndice correcto para arrays con \u00edndice cero para evitar acceder a memoria m\u00e1s all\u00e1 de los l\u00edmites del array asignado."}], "id": "CVE-2025-40180", "lastModified": "2026-10-30T13:18:14.400", "metrics": {}, "published": "2025-11-12T22:15:44.737", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0aead8197fc1a85b0a89646e418feb49a564b029"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47a92030422d09c2de0633d23f660a65b717f008"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab96f08ecedd263ecaab9df8455bfb23b07fdcc2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b91951f76be14a393439c7063974b4d26f3cb64f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd0cbf2713f6e027ebba867cb7409ae345a31312"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop", "id": "2414713", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414713"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop\nThe cleanup loop was starting at the wrong array index, causing\nout-of-bounds access.\nStart the loop at the correct index for zero-indexed arrays to prevent\naccessing memory beyond the allocated array bounds."], "name": "CVE-2025-40180", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40180\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40180\nhttps://lore.kernel.org/linux-cve-announce/2025111243-CVE-2025-40180-8258@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-13T09:52:10.197109+00:00", "updated": "2025-11-13T09:52:10.197136+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}