PT-2025-46634 · Linux+2 · Linux Kernel+2
Published
2025-11-12
·
Updated
2026-05-07
·
CVE-2025-40159
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a flaw in the xsk module related to the validation of userspace-supplied xdp desc. Specifically, certain invalid values provided in the xdp desc from userspace could bypass validation checks, potentially leading to undefined behavior or the queuing of invalid frames for transmission. This issue arises from potential integer overflows when calculating memory addresses and lengths within the xdp desc structure. The vulnerability does not affect valid XSk applications but can be exploited through crafted input. The fix involves promoting the
desc->len value to a 64-bit integer to prevent positive overflows and using explicit overflow checks when validating desc->addr.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu