What is CVE-2025-40159?

CVE-2025-40159 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 6.8 onward and patched in 6.12.54, 6.17.4 and 6.18. CVE-2025-40159 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2025-40159?

CVE-2025-40159 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2025-40159?

Yes, CVE-2025-40159 has been patched. Fixed versions include 6.12.54, 6.17.4 and 6.18. If you are running Linux kernel 6.8 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2025-40159 actively exploited?

CVE-2025-40159 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2025-40159

High

In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or just invalid frames to be queued for xmit. desc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len can cause positive integer overflow and wraparound, the same way low enough desc->addr with a non-zero pool->tx_metadata_len can cause negative integer overflow. Both scenarios can then pass the validation successfully. This doesn't happen with valid XSk applications, but can be used to perform attacks. Always promote desc->len to ``u64`` first to exclude positive overflows of it. Use explicit check_{add,sub}_overflow() when validating desc->addr (which is ``u64`` already). bloat-o-meter reports a little growth of the code size: add/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44) Function old new delta xskq_cons_peek_desc 299 330 +31 xsk_tx_peek_release_desc_batch 973 1002 +29 xsk_generic_xmit 3148 3132 -16 but hopefully this doesn't hurt the performance much.

Package Linux Kernel

Published 2025-11-12

Last modified 2026-07-30

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 6.8 and later are affected. Fixed in 6.12.54, 6.17.4, 6.18 and their respective stable series.

Affected from

≥ 6.8

Fixed in

✓ 6.12.54 6.12.x ✓ 6.17.4 6.17.x ✓ 6.18

References

3 total

Details

CVE ID CVE-2025-40159

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2025-11-12

Modified 2026-07-30

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2025-40159?

CVE-2025-40159 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 6.8 onward and has been patched in 6.12.54, 6.17.4 and 6.18. CVE-2025-40159 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2025-40159?

CVE-2025-40159 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2025-40159?

Yes. CVE-2025-40159 has been patched. Fixed versions include 6.12.54, 6.17.4 and 6.18. If you are running Linux kernel 6.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2025-40159 actively exploited?

No. CVE-2025-40159 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.