CVE-2025-40199

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40199", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.178Z", "datePublished": "2025-11-12T21:56:33.510Z", "dateUpdated": "2026-10-15T22:02:40.424Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:28.841Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches\n\nHelge reported that the introduction of PP_MAGIC_MASK let to crashes on\nboot on his 32-bit parisc machine. The cause of this is the mask is set\ntoo wide, so the page_pool_page_is_pp() incurs false positives which\ncrashes the machine.\n\nJust disabling the check in page_pool_is_pp() will lead to the page_pool\ncode itself malfunctioning; so instead of doing this, this patch changes\nthe define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel\npointers for page_pool-tagged pages.\n\nThe fix relies on the kernel pointers that alias with the pp_magic field\nalways being above PAGE_OFFSET. With this assumption, we can use the\nlowest bit of the value of PAGE_OFFSET as the upper bound of the\nPP_DMA_INDEX_MASK, which should avoid the false positives.\n\nBecause we cannot rely on PAGE_OFFSET always being a compile-time\nconstant, nor on it always being >0, we fall back to disabling the\ndma_index storage when there are not enough bits available. This leaves\nus in the situation we were in before the patch in the Fixes tag, but\nonly on a subset of architecture configurations. This seems to be the\nbest we can do until the transition to page types in complete for\npage_pool pages.\n\nv2:\n- Make sure there's at least 8 bits available and that the PAGE_OFFSET\n bit calculation doesn't wrap"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The broken `PP_MAGIC_MASK` is evaluated on every page free/alloc check and on every page_pool skb recycle, driven by ordinary local memory and I/O activity rather than by attacker-supplied packet content; an unprivileged local process reliably reaches `free_page_is_bad()`/`napi_pp_put_page()` through normal slab and socket buffer churn. No remote input influences the aliased pointer values, so Local is the accurate vector.\nAC:L - On an affected architecture (32-bit parisc/m68k/nommu targets whose default `PAGE_OFFSET < 0x40000000`) the false positive is deterministic and occurs with no special setup \u2014 it fires during boot on stock configuration, and any page-allocation churn reproduces it. No condition beyond the attacker's control is required.\nPR:L - Any unprivileged local user can drive slab page frees and network buffer recycling that funnel pages through `page_pool_page_is_pp()`/`netmem_is_pp()`; no capability, namespace privilege, or root is needed. The condition even manifests spontaneously under the init process during boot.\nUI:N - No victim action is required \u2014 the misidentification happens inside the page allocator and skb free paths during normal kernel operation.\nS:U - Both the flawed check and its consequences (page allocator state, page_pool/skb handling) live entirely within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - A false positive in `netmem_is_pp()` causes `page->mapping` to be reinterpreted as a `struct page_pool *` and dereferenced throughout `page_pool_put_unrefed_netmem()`, giving a type-confusion read primitive over arbitrary kernel memory; `bad_page()` additionally dumps raw `struct page` contents and kernel pointers to the log.\nI:H - The same type confusion lets `page_pool_recycle_in_cache()`/`page_pool_recycle_in_ring()` write netmem values and update counters at offsets from an uncontrolled kernel pointer, and `skb_pp_frag_ref()` performs `atomic_long_inc()` on the `page->private`-aliased `pp_ref_count`, corrupting page-cache metadata \u2014 memory corruption leverageable for control-flow hijack.\nA:H - The reported symptom is a machine crash on boot: every affected slab page free triggers a \"BUG: Bad page state ... page_pool leak\" splat and permanently leaks the page, exhausting memory, while the network path oopses on a wild `page_pool` pointer dereference."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/mm.h", "net/core/page_pool.c"], "versions": [{"version": "4f51fb0d257ff4d406ec27966902de075e3b118e", "lessThan": "15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a", "status": "affected", "versionType": "git"}, {"version": "ee62ce7a1d909ccba0399680a03c2dee83bcae95", "lessThan": "f62934cea32c8f7b11b747975d69bf5afe4264cf", "status": "affected", "versionType": "git"}, {"version": "ee62ce7a1d909ccba0399680a03c2dee83bcae95", "lessThan": "95920c2ed02bde551ab654e9749c2ca7bc3100e0", "status": "affected", "versionType": "git"}, {"version": "c30ae60f41f9edd6e1b5cad41cf28ce04dae39e4", "status": "affected", "versionType": "git"}, {"version": "6.12.34", "lessThan": "6.12.54", "status": "affected", "versionType": "semver"}, {"version": "6.15.3", "lessThan": "6.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/mm.h", "net/core/page_pool.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.54", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.4", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.34", "versionEndExcluding": "6.12.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.17.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a"}, {"url": "https://git.kernel.org/stable/c/f62934cea32c8f7b11b747975d69bf5afe4264cf"}, {"url": "https://git.kernel.org/stable/c/95920c2ed02bde551ab654e9749c2ca7bc3100e0"}], "title": "page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40199", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:57.920017Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:40.424Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40199", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:57.920017Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:57:58.899Z"}}], "cna": {"title": "page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The broken `PP_MAGIC_MASK` is evaluated on every page free/alloc check and on every page_pool skb recycle, driven by ordinary local memory and I/O activity rather than by attacker-supplied packet content; an unprivileged local process reliably reaches `free_page_is_bad()`/`napi_pp_put_page()` through normal slab and socket buffer churn. No remote input influences the aliased pointer values, so Local is the accurate vector.\nAC:L - On an affected architecture (32-bit parisc/m68k/nommu targets whose default `PAGE_OFFSET < 0x40000000`) the false positive is deterministic and occurs with no special setup \u2014 it fires during boot on stock configuration, and any page-allocation churn reproduces it. No condition beyond the attacker's control is required.\nPR:L - Any unprivileged local user can drive slab page frees and network buffer recycling that funnel pages through `page_pool_page_is_pp()`/`netmem_is_pp()`; no capability, namespace privilege, or root is needed. The condition even manifests spontaneously under the init process during boot.\nUI:N - No victim action is required \u2014 the misidentification happens inside the page allocator and skb free paths during normal kernel operation.\nS:U - Both the flawed check and its consequences (page allocator state, page_pool/skb handling) live entirely within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - A false positive in `netmem_is_pp()` causes `page->mapping` to be reinterpreted as a `struct page_pool *` and dereferenced throughout `page_pool_put_unrefed_netmem()`, giving a type-confusion read primitive over arbitrary kernel memory; `bad_page()` additionally dumps raw `struct page` contents and kernel pointers to the log.\nI:H - The same type confusion lets `page_pool_recycle_in_cache()`/`page_pool_recycle_in_ring()` write netmem values and update counters at offsets from an uncontrolled kernel pointer, and `skb_pp_frag_ref()` performs `atomic_long_inc()` on the `page->private`-aliased `pp_ref_count`, corrupting page-cache metadata \u2014 memory corruption leverageable for control-flow hijack.\nA:H - The reported symptom is a machine crash on boot: every affected slab page free triggers a \"BUG: Bad page state ... page_pool leak\" splat and permanently leaks the page, exhausting memory, while the network path oopses on a wild `page_pool` pointer dereference."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4f51fb0d257ff4d406ec27966902de075e3b118e", "lessThan": "15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a", "versionType": "git"}, {"status": "affected", "version": "ee62ce7a1d909ccba0399680a03c2dee83bcae95", "lessThan": "f62934cea32c8f7b11b747975d69bf5afe4264cf", "versionType": "git"}, {"status": "affected", "version": "ee62ce7a1d909ccba0399680a03c2dee83bcae95", "lessThan": "95920c2ed02bde551ab654e9749c2ca7bc3100e0", "versionType": "git"}, {"status": "affected", "version": "c30ae60f41f9edd6e1b5cad41cf28ce04dae39e4", "versionType": "git"}, {"status": "affected", "version": "6.12.34", "lessThan": "6.12.54", "versionType": "semver"}, {"status": "affected", "version": "6.15.3", "lessThan": "6.16", "versionType": "semver"}], "programFiles": ["include/linux/mm.h", "net/core/page_pool.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.54", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.4", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/mm.h", "net/core/page_pool.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a"}, {"url": "https://git.kernel.org/stable/c/f62934cea32c8f7b11b747975d69bf5afe4264cf"}, {"url": "https://git.kernel.org/stable/c/95920c2ed02bde551ab654e9749c2ca7bc3100e0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches\n\nHelge reported that the introduction of PP_MAGIC_MASK let to crashes on\nboot on his 32-bit parisc machine. The cause of this is the mask is set\ntoo wide, so the page_pool_page_is_pp() incurs false positives which\ncrashes the machine.\n\nJust disabling the check in page_pool_is_pp() will lead to the page_pool\ncode itself malfunctioning; so instead of doing this, this patch changes\nthe define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel\npointers for page_pool-tagged pages.\n\nThe fix relies on the kernel pointers that alias with the pp_magic field\nalways being above PAGE_OFFSET. With this assumption, we can use the\nlowest bit of the value of PAGE_OFFSET as the upper bound of the\nPP_DMA_INDEX_MASK, which should avoid the false positives.\n\nBecause we cannot rely on PAGE_OFFSET always being a compile-time\nconstant, nor on it always being >0, we fall back to disabling the\ndma_index storage when there are not enough bits available. This leaves\nus in the situation we were in before the patch in the Fixes tag, but\nonly on a subset of architecture configurations. This seems to be the\nbest we can do until the transition to page types in complete for\npage_pool pages.\n\nv2:\n- Make sure there's at least 8 bits available and that the PAGE_OFFSET\n bit calculation doesn't wrap"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.54", "versionStartIncluding": "6.12.34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.4", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.15.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:28.841Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40199", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:40.424Z", "dateReserved": "2025-04-16T07:20:57.178Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-11-12T21:56:33.510Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/mm.h", "net/core/page_pool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a", "status": "affected", "version": "4f51fb0d257ff4d406ec27966902de075e3b118e", "versionType": "git"}, {"lessThan": "f62934cea32c8f7b11b747975d69bf5afe4264cf", "status": "affected", "version": "ee62ce7a1d909ccba0399680a03c2dee83bcae95", "versionType": "git"}, {"lessThan": "95920c2ed02bde551ab654e9749c2ca7bc3100e0", "status": "affected", "version": "ee62ce7a1d909ccba0399680a03c2dee83bcae95", "versionType": "git"}, {"status": "affected", "version": "c30ae60f41f9edd6e1b5cad41cf28ce04dae39e4", "versionType": "git"}, {"lessThan": "6.12.54", "status": "affected", "version": "6.12.34", "versionType": "semver"}, {"lessThan": "6.16", "status": "affected", "version": "6.15.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/mm.h", "net/core/page_pool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.54", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches\n\nHelge reported that the introduction of PP_MAGIC_MASK let to crashes on\nboot on his 32-bit parisc machine. The cause of this is the mask is set\ntoo wide, so the page_pool_page_is_pp() incurs false positives which\ncrashes the machine.\n\nJust disabling the check in page_pool_is_pp() will lead to the page_pool\ncode itself malfunctioning; so instead of doing this, this patch changes\nthe define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel\npointers for page_pool-tagged pages.\n\nThe fix relies on the kernel pointers that alias with the pp_magic field\nalways being above PAGE_OFFSET. With this assumption, we can use the\nlowest bit of the value of PAGE_OFFSET as the upper bound of the\nPP_DMA_INDEX_MASK, which should avoid the false positives.\n\nBecause we cannot rely on PAGE_OFFSET always being a compile-time\nconstant, nor on it always being >0, we fall back to disabling the\ndma_index storage when there are not enough bits available. This leaves\nus in the situation we were in before the patch in the Fixes tag, but\nonly on a subset of architecture configurations. This seems to be the\nbest we can do until the transition to page types in complete for\npage_pool pages.\n\nv2:\n- Make sure there's at least 8 bits available and that the PAGE_OFFSET\n bit calculation doesn't wrap"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npage_pool: Correcci\u00f3n de PP_MAGIC_MASK para evitar fallos en algunas arquitecturas de 32 bits\n\nHelge inform\u00f3 que la introducci\u00f3n de PP_MAGIC_MASK provoc\u00f3 fallos durante el arranque en su m\u00e1quina parisc de 32 bits. La causa de esto es que la m\u00e1scara est\u00e1 configurada demasiado amplia, por lo que page_pool_page_is_pp() incurre en falsos positivos, lo que provoca el fallo de la m\u00e1quina.\n\nSimplemente deshabilitar la comprobaci\u00f3n en page_pool_is_pp() har\u00eda que el propio c\u00f3digo de page_pool funcionara mal; as\u00ed que, en lugar de hacer esto, este parche cambia la definici\u00f3n de PP_DMA_INDEX_BITS para evitar confundir punteros arbitrarios del kernel con p\u00e1ginas etiquetadas como page_pool.\n\nLa soluci\u00f3n se basa en que los punteros del kernel que se superponen con el campo pp_magic siempre est\u00e9n por encima de PAGE_OFFSET. Con esta suposici\u00f3n, podemos usar el bit m\u00e1s bajo del valor de PAGE_OFFSET como l\u00edmite superior de PP_DMA_INDEX_MASK, lo que deber\u00eda evitar los falsos positivos.\n\nDado que no podemos confiar en que PAGE_OFFSET sea siempre una constante en tiempo de compilaci\u00f3n, ni en que siempre sea >0, recurrimos a deshabilitar el almacenamiento de dma_index cuando no hay suficientes bits disponibles. Esto nos deja en la situaci\u00f3n en la que est\u00e1bamos antes del parche en la etiqueta Fixes, pero solo en un subconjunto de configuraciones de arquitectura. Esto parece ser lo mejor que podemos hacer hasta que la transici\u00f3n a los tipos de p\u00e1gina est\u00e9 completa para las p\u00e1ginas de page_pool.\n\nv2:\n- Asegurarse de que haya al menos 8 bits disponibles y de que el c\u00e1lculo de bits de PAGE_OFFSET no se desborde."}], "id": "CVE-2025-40199", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40199", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:57:57.920017Z", "version": "2.0.3"}}]}, "published": "2025-11-12T22:15:47.043", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/95920c2ed02bde551ab654e9749c2ca7bc3100e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f62934cea32c8f7b11b747975d69bf5afe4264cf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches", "id": "2414733", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414733"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40199", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40199\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40199\nhttps://lore.kernel.org/linux-cve-announce/2025111246-CVE-2025-40199-054c@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-13T09:52:09.198637+00:00", "updated": "2025-11-13T09:52:09.198663+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}