BaseFortify

Publication date: 2025-10-24

Last updated on: 2025-10-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-24

Last Modified

2025-10-29

Generated

2026-07-06

AI Q&A

2025-10-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-40019

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the essiv cryptographic module where the ssize (size of the data) check was not properly performed for decryption and in-place encryption operations. The fix moves the ssize check to the start of the essiv_aead_crypt function to ensure it is checked for these operations, preventing potential issues related to improper data size handling during cryptographic processes.

Impact Analysis

If unpatched, this vulnerability could lead to improper handling of data sizes during decryption and in-place encryption in the essiv cryptographic module, potentially causing cryptographic errors or security weaknesses. This might affect the integrity or confidentiality of encrypted data processed by the Linux kernel.

Hi! I’m here to help you understand CVE-2025-40019. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70