CVE-2025-40012
BaseFortify
Publication date: 2025-10-20
Last updated on: 2025-10-21
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's smc_rx_splice() function where memory allocated with kzalloc() (which is not page-backed) is passed to get_page(). This triggers a warning and prevents holding a reference count on the buffer, potentially leading to a use-after-free condition if the memory is released before splice_to_pipe() completes. The fix involves using folio_alloc() to allocate page-backed memory, making it safe for get_page().
How can this vulnerability impact me? :
The vulnerability can lead to a use-after-free condition in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for warnings related to smc_rx_splice() and get_page(), specifically WARN_ON_ONCE() messages triggered by passing kmalloc memory to get_page(). You can check the kernel logs using commands like: dmesg | grep smc_rx_splice or journalctl -k | grep smc_rx_splice to identify relevant warnings.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this issue is fixed by replacing kzalloc() with folio_alloc() for DMB buffers in smc_lo_register_dmb(), ensuring buffers are page-backed and safe for get_page(). Until an update is applied, monitoring for related kernel warnings and avoiding use of affected smc features may reduce risk.