Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-40019— crypto: essiv - Check ssize for decryption and in-place encryption

Quick assessment

Affected
Linux Linux
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未检查ssize值，可能导致加密和解密操作中的安全问题。

AI Predicted 5.9 Difficulty: Trivial EPSS 0.29% · P20

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux be1eb7f78aa8fbe34779c56c266ccd0364604e71< 29294dd6f1e7acf527255fb136ffde6602c3a129 affected
be1eb7f78aa8fbe34779c56c266ccd0364604e71< 71f03f8f72d9c70ffba76980e78b38c180e61589 affected
be1eb7f78aa8fbe34779c56c266ccd0364604e71< df58651968f82344a0ed2afdafd20ecfc55ff548 affected
be1eb7f78aa8fbe34779c56c266ccd0364604e71< 248ff2797ff52a8cbf86507f9583437443bf7685 affected
be1eb7f78aa8fbe34779c56c266ccd0364604e71< f37e7860dc5e94c70b4a3e38a5809181310ea9ac affected
be1eb7f78aa8fbe34779c56c266ccd0364604e71< dc4c854a5e7453c465fa73b153eba4ef2a240abe affected
be1eb7f78aa8fbe34779c56c266ccd0364604e71< da7afb01ba05577ba3629f7f4824205550644986 affected
be1eb7f78aa8fbe34779c56c266ccd0364604e71< 6bb73db6948c2de23e407fe1b7ef94bf02b7529f affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-40019

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
crypto: essiv - Check ssize for decryption and in-place encryption
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未检查ssize值，可能导致加密和解密操作中的安全问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux be1eb7f78aa8fbe34779c56c266ccd0364604e71 ~ 29294dd6f1e7acf527255fb136ffde6602c3a129 -
Linux Linux 5.4 -

II. Public POCs for CVE-2025-40019

# POC Description Source Link Shenlong Link
1 maybe a poc for CVE-2025-40019 https://github.com/guard-wait/CVE-2025-40019_POC POC Details
2 A PoC for CVE-2025-40019 in ESSIV module. (exploit WIP) https://github.com/xooxo/CVE-2025-40019-Essiv POC Details
3 A Proof Of Concept for CVE-2025-40019 https://github.com/0xAtharv/CVE-2025-40019-POC POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-40019

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-40019 (2)

Same Patch Batch · Linux · 2025-10-24 · 8 CVEs total

CVE-2023-53733 7.8 HIGH net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
CVE-2025-40018 7.8 HIGH ipvs: Defer ip_vs_ftp unregister during netns cleanup
CVE-2025-40024 7.8 HIGH vhost: Take a reference on the task in struct vhost_task.
CVE-2025-40020 can: peak_usb: fix shift-out-of-bounds issue
CVE-2025-40021 tracing: dynevent: Add a missing lockdown check on dynevent
CVE-2025-40022 crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
CVE-2025-40023 drm/xe/vf: Don't expose sysfs attributes not applicable for VFs

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-40019

No comments yet

Leave a comment