CVE-2025-40031

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tee: fix register_shm_helper()

In register_shm_helper(), fix incorrect error handling for a call to iov_iter_extract_pages(). A case is missing for when iov_iter_extract_pages() only got some pages and return a number larger than 0, but not the requested amount.

This fixes a possible NULL pointer dereference following a bad input from ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.

Metrics

No CVSS score has been published yet.

Affected software

VendorProductVersions
LinuxLinux>= 7bdee41575919773818e525ea19e54eb817770af, < 9338093db954918558677a468d32e77041c65167; >= 7bdee41575919773818e525ea19e54eb817770af, < 6a7874ab814ce12003c46a92f7afc9b035c8e8e9; >= 7bdee41575919773818e525ea19e54eb817770af, < d5cf5b37064b1699d946e8b7ab4ac7d7d101814c
LinuxLinux6.8

References

Timeline

Published
Oct 28, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-40032In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before relCVE-2025-40033In the Linux kernel, the following vulnerability has been resolved: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_seCVE-2025-40034In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() When platfoCVE-2025-40035In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info lCVE-2025-40036In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix possible map leak in fastrpc_put_args copy_to_user(CVE-2025-40037In the Linux kernel, the following vulnerability has been resolved: fbdev: simplefb: Fix use after free in simplefb_detach_genpds() The pmCVE-2025-400387.1In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid SCVE-2025-400394.7In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_hanCVE-2025-40049.8A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been declared as critical. This vulnerability affects CVE-2025-400405.5In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discoveredCVE-2025-400417.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign-extend struct ops return values properly The ns_bCVE-2025-40042In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initialization causing NULL point
CVE-2025-40031: Unscored | Vulnix