Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-40290— xsk: avoid data corruption on cq descriptor number

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于skb控制块使用不当，可能导致空指针取消引用。

CVSS 7.8 · High EPSS 0.14% · P3

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 30f241fcf52aaaef7ac16e66530faa11be78a865< c5ea2e50b5c9aa80c5b53526257540f0c26cd66d affected
30f241fcf52aaaef7ac16e66530faa11be78a865< 0ebc27a4c67d44e5ce88d21cdad8201862b78837 affected
932cb57e675a62982d4719e4b04e9f09a15a5baf affected
6.16.8< 6.17 affected
6.17 affected
< 6.17 unaffected
6.17.11≤ 6.17.* unaffected
6.18≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-40290

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xsk: avoid data corruption on cq descriptor number
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xsk: avoid data corruption on cq descriptor number Since commit 30f241fcf52a ("xsk: Fix immature cq descriptor production"), the descriptor number is stored in skb control block and xsk_cq_submit_addr_locked() relies on it to put the umem addrs onto pool's completion queue. skb control block shouldn't be used for this purpose as after transmit xsk doesn't have control over it and other subsystems could use it. This leads to the following kernel panic due to a NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 1 PID: 927 Comm: p4xsk.bin Not tainted 6.16.12+deb14-cloud-amd64 #1 PREEMPT(lazy) Debian 6.16.12-1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:xsk_destruct_skb+0xd0/0x180 [...] Call Trace: <IRQ> ? napi_complete_done+0x7a/0x1a0 ip_rcv_core+0x1bb/0x340 ip_rcv+0x30/0x1f0 __netif_receive_skb_one_core+0x85/0xa0 process_backlog+0x87/0x130 __napi_poll+0x28/0x180 net_rx_action+0x339/0x420 handle_softirqs+0xdc/0x320 ? handle_edge_irq+0x90/0x1e0 do_softirq.part.0+0x3b/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x60/0x70 __dev_direct_xmit+0x14e/0x1f0 __xsk_generic_xmit+0x482/0xb70 ? __remove_hrtimer+0x41/0xa0 ? __xsk_generic_xmit+0x51/0xb70 ? _raw_spin_unlock_irqrestore+0xe/0x40 xsk_sendmsg+0xda/0x1c0 __sys_sendto+0x1ee/0x200 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x84/0x2f0 ? __pfx_pollwake+0x10/0x10 ? __rseq_handle_notify_resume+0xad/0x4c0 ? restore_fpregs_from_fpstate+0x3c/0x90 ? switch_fpu_return+0x5b/0xe0 ? do_syscall_64+0x204/0x2f0 ? do_syscall_64+0x204/0x2f0 ? do_syscall_64+0x204/0x2f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> [...] Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: 0x1c000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Instead use the skb destructor_arg pointer along with pointer tagging. As pointers are always aligned to 8B, use the bottom bit to indicate whether this a single address or an allocated struct containing several addresses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于skb控制块使用不当，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 30f241fcf52aaaef7ac16e66530faa11be78a865 ~ c5ea2e50b5c9aa80c5b53526257540f0c26cd66d -
Linux Linux 6.17 -

II. Public POCs for CVE-2025-40290

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-40290

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-12-08 · 82 CVEs total

CVE-2025-40320 9.8 CRITICAL smb: client: fix potential cfid UAF in smb2_query_info_compound
CVE-2023-53751 9.8 CRITICAL cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname
CVE-2023-53769 9.3 CRITICAL virt/coco/sev-guest: Double-buffer messages
CVE-2023-53764 8.8 HIGH wifi: ath12k: Handle lock during peer_id find
CVE-2023-53762 8.8 HIGH Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync
CVE-2025-40318 8.8 HIGH Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
CVE-2025-40292 8.4 HIGH virtio-net: fix received length check in big packets
CVE-2025-40309 8.0 HIGH Bluetooth: SCO: Fix UAF on sco_conn_free
CVE-2023-53752 7.8 HIGH net: deal with integer overflows in kmalloc_reserve()
CVE-2023-53753 7.8 HIGH drm/amd/display: fix mapping to non-allocated address
CVE-2025-40323 7.8 HIGH fbcon: Set fb_display[i]->mode to NULL when the mode is released
CVE-2023-53747 7.8 HIGH vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
CVE-2025-40319 7.8 HIGH bpf: Sync pending IRQ work before freeing ring buffer
CVE-2022-50623 7.8 HIGH fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
CVE-2023-53759 7.8 HIGH HID: hidraw: fix data race on device refcount
CVE-2022-50630 7.8 HIGH mm: hugetlb: fix UAF in hugetlb_handle_userfault
CVE-2023-53763 7.8 HIGH Revert "f2fs: fix to do sanity check on extent cache correctly"
CVE-2025-40317 7.8 HIGH regmap: slimbus: fix bus_context pointer in regmap init calls
CVE-2023-53768 7.8 HIGH regmap-irq: Fix out-of-bounds access when allocating config buffers
CVE-2025-40304 7.8 HIGH fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

Showing top 20 of 82 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-40290

No comments yet

Leave a comment