CVE-2025-40302
In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid remove_bufs when legacy fileio is active vb2_ioctl_remove_bufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl when fileio is active to protect internal queue state between subsequent read/write calls.
Affected versions
Linux kernel versions
6.10
and later are affected. Fixed in
6.12.58,
6.17.8,
6.18
and their respective stable series.
References
The following references provide additional information about CVE-2025-40302 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/27afd6e066cfd80ddbe22a4a11b99174ac89cced
-
PatchKernel patch commithttps://git.kernel.org/stable/c/a6a493b985bfffac097a4e1be09f98b27729dca8
-
PatchKernel patch commithttps://git.kernel.org/stable/c/e819b34df0a7030a15c968d619fa8a3ed2455c7a
Frequently asked questions
-
What is CVE-2025-40302?
CVE-2025-40302 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.10 onward and has been patched in 6.12.58, 6.17.8 and 6.18. CVE-2025-40302 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2025-40302?
Yes — CVE-2025-40302 has been patched. Fixed versions include 6.12.58, 6.17.8 and 6.18. If you are running Linux kernel 6.10 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2025-40302 actively exploited?
No — CVE-2025-40302 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.