PT-2025-17296 · Linux+2 · Linux Kernel+2

Published 2023-11-13 · Updated 2026-04-20 · CVE-2025-40364

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, specifically in the io uring component. The issue is related to the io req prep async() function, which can import provided buffers and commit the ring state. If the function gives up on the buffers before they are committed, they will be reimported later if needed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2025-12027

CVE-2025-40364

OESA-2025-1729

OESA-2025-1730

OPENSUSE-SU-2025:20091-1

SUSE-SU-2025:01982-1

SUSE-SU-2025:21080-1

SUSE-SU-2025:21147-1

SUSE-SU-2025:21180-1

SUSE-SU-2025_01982-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 406

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40364.json · Exploit
• 🔥 https://github.com/star-sg/security-research/tree/CVE-2025-40364_lts_cos/pocs/linux/kernelctf/CVE-2025-40364_lts_cos · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-40364 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38385 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38007 · Security Note
• https://git.kernel.org/stable/c/35ae7910c349fb3c60439992e2e0e79061e95382 · Patch
• https://cve.org/CVERecord?id=CVE-2025-40364 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-58085 · Security Note
• https://git.kernel.org/stable/c/b86f1d51731e621e83305dc9564ae14c9ef752bf · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:01982-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-40364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23149 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57896 · Security Note
• https://git.kernel.org/stable/c/f0ef94553868d07c1b14d7743a7e2553e5a831a3 · Patch