CVE-2025-40178— pid: Add a judgment for ns null in pid_nr_ns
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于pid_nr_ns函数未检查ns空指针，可能导致内核崩溃。
Affected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 17cf22c33e1f1b5e435469c84e43872579497653< 75dbc029c5359438be4a6f908bfbfdab969af776 |
affected |
17cf22c33e1f1b5e435469c84e43872579497653< c2d09d724856b6f82ab688f65fc1ce833bb56333 |
affected | ||
17cf22c33e1f1b5e435469c84e43872579497653< c3b654021931dc806ba086c549e8756c3f204a67 |
affected | ||
17cf22c33e1f1b5e435469c84e43872579497653< e10c36a771c5cc910abd9fe4aa9033ee32a47c38 |
affected | ||
17cf22c33e1f1b5e435469c84e43872579497653< 09d227c59d97efda7d5cc878a4335a6b2bb224c2 |
affected | ||
17cf22c33e1f1b5e435469c84e43872579497653< 2076b916bf41be48799d1443df0f8fc75d12ccd0 |
affected | ||
17cf22c33e1f1b5e435469c84e43872579497653< a0212978af1825b37da0b453b94d9b0e5af11478 |
affected | ||
17cf22c33e1f1b5e435469c84e43872579497653< 006568ab4c5ca2309ceb36fa553e390b4aa9c0c7 |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-40178
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
pid: Add a judgment for ns null in pid_nr_ns
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
pid: Add a judgment for ns null in pid_nr_ns
__task_pid_nr_ns
ns = task_active_pid_ns(current);
pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns);
if (pid && ns->level <= pid->level) {
Sometimes null is returned for task_active_pid_ns. Then it will trigger kernel panic in pid_nr_ns.
For example:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058
Mem abort info:
ESR = 0x0000000096000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 39-bit VAs, pgdp=00000002175aa000
[0000000000000058] pgd=08000002175ab003, p4d=08000002175ab003, pud=08000002175ab003, pmd=08000002175be003, pte=0000000000000000
pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __task_pid_nr_ns+0x74/0xd0
lr : __task_pid_nr_ns+0x24/0xd0
sp : ffffffc08001bd10
x29: ffffffc08001bd10 x28: ffffffd4422b2000 x27: 0000000000000001
x26: ffffffd442821168 x25: ffffffd442821000 x24: 00000f89492eab31
x23: 00000000000000c0 x22: ffffff806f5693c0 x21: ffffff806f5693c0
x20: 0000000000000001 x19: 0000000000000000 x18: 0000000000000000
x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 00000000023a1adc
x14: 0000000000000003 x13: 00000000007ef6d8 x12: 001167c391c78800
x11: 00ffffffffffffff x10: 0000000000000000 x9 : 0000000000000001
x8 : ffffff80816fa3c0 x7 : 0000000000000000 x6 : 49534d702d535449
x5 : ffffffc080c4c2c0 x4 : ffffffd43ee128c8 x3 : ffffffd43ee124dc
x2 : 0000000000000000 x1 : 0000000000000001 x0 : ffffff806f5693c0
Call trace:
__task_pid_nr_ns+0x74/0xd0
...
__handle_irq_event_percpu+0xd4/0x284
handle_irq_event+0x48/0xb0
handle_fasteoi_irq+0x160/0x2d8
generic_handle_domain_irq+0x44/0x60
gic_handle_irq+0x4c/0x114
call_on_irq_stack+0x3c/0x74
do_interrupt_handler+0x4c/0x84
el1_interrupt+0x34/0x58
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x68/0x6c
account_kernel_stack+0x60/0x144
exit_task_stack_account+0x1c/0x80
do_exit+0x7e4/0xaf8
...
get_signal+0x7bc/0x8d8
do_notify_resume+0x128/0x828
el0_svc+0x6c/0x70
el0t_64_sync_handler+0x68/0xbc
el0t_64_sync+0x1a8/0x1ac
Code: 35fffe54 911a02a8 f9400108 b4000128 (b9405a69)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Oops: Fatal exception in interrupt
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于pid_nr_ns函数未检查ns空指针，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-40178
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-40178
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-11-12 · 96 CVEs total
| CVE-2025-40176 | 9.8 CRITICAL | tls: wait for pending async decryptions if tls_strp_msg_hold fails |
| CVE-2025-40140 | 8.8 HIGH | net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast |
| CVE-2025-40133 | 8.1 HIGH | mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). |
| CVE-2025-40204 | 8.1 HIGH | sctp: Fix MAC comparison to be constant-time |
| CVE-2025-40168 | 8.1 HIGH | smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). |
| CVE-2025-40158 | 8.1 HIGH | ipv6: use RCU in ip6_output() |
| CVE-2025-40135 | 8.1 HIGH | ipv6: use RCU in ip6_xmit() |
| CVE-2025-40186 | 8.1 HIGH | tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). |
| CVE-2025-40141 | 8.0 HIGH | Bluetooth: ISO: Fix possible UAF on iso_conn_free |
| CVE-2025-40167 | 7.8 HIGH | ext4: detect invalid INLINE_DATA + EXTENTS flag combination |
| CVE-2025-40159 | 7.8 HIGH | xsk: Harden userspace-supplied xdp_desc validation |
| CVE-2025-40166 | 7.8 HIGH | drm/xe/guc: Check GuC running state before deregistering exec queue |
| CVE-2025-40165 | 7.8 HIGH | media: nxp: imx8-isi: m2m: Fix streaming cleanup on release |
| CVE-2025-40151 | 7.8 HIGH | LoongArch: BPF: No support of struct argument in trampoline programs |
| CVE-2025-40149 | 7.8 HIGH | tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). |
| CVE-2025-40172 | 7.8 HIGH | accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() |
| CVE-2025-40169 | 7.8 HIGH | bpf: Reject negative offsets for ALU ops |
| CVE-2025-40201 | 7.8 HIGH | kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths |
| CVE-2025-40203 | 7.8 HIGH | listmount: don't call path_put() under namespace semaphore |
| CVE-2025-40205 | 7.8 HIGH | btrfs: avoid potential out-of-bounds in btrfs_encode_fh() |
Showing top 20 of 96 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2025-40178
No comments yet