CVE-2025-40266

HighCVSS 8.2/10Last modified Oct 18, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Check the untrusted offset in FF-A memory share

Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < fc3139d9f4c1fe1c7d5f25f99676bd8e9c6a1041; >= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < bc1909ef38788f2ee3d8011d70bf029948433051; >= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < f9f1aed6c8a3427900da3121e1868124854569c3; >= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < 103e17aac09cdd358133f9e00998b75d6c1f1518
LinuxLinux3.11

References

Timeline

Published
Dec 4, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-40267In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: ensure allocated iovec gets cleared for early failure A pCVE-2025-40268In the Linux kernel, the following vulnerability has been resolved: cifs: client: fix memory leak in smb3_fs_context_parse_param The user CVE-2025-402697.8In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCMCVE-2025-40279.8A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown functiCVE-2025-402707.8In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix potential UAF issue for VMA readahead Since commit 78524CVE-2025-402717.8In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtreeCVE-2025-402727.8In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix use-after-free race in fault handler When a page fauCVE-2025-402738.8In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copyCVE-2025-402747.8In the Linux kernel, the following vulnerability has been resolved: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dyinCVE-2025-40275In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controlsCVE-2025-402767.3In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached ThCVE-2025-402777.8In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
CVE-2025-40266: High severity, CVSS 8.2 | Vulnix