CVE-2025-40291

HighCVSS 7.8/10Last modified Oct 14, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix regbuf vector size truncation

There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflow "int"s used later. Rough but simple, can be improved on top.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5, < 826ce37a842633efe1bb763e4b13045d74060d72; >= 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5, < 146eb58629f45f8297e83d69e64d4eea4b28d972
LinuxLinux6.15

References

Timeline

Published
Dec 8, 2025
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-402928.4In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix received length check in big packets Since commit 4959CVE-2025-40293In the Linux kernel, the following vulnerability has been resolved: iommufd: Don't overflow during division for dirty tracking If pgshift CVE-2025-40294In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the CVE-2025-40295In the Linux kernel, the following vulnerability has been resolved: fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT WCVE-2025-40296In the Linux kernel, the following vulnerability has been resolved: platform/x86: int3472: Fix double free of GPIO device during unregisterCVE-2025-402977.8In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix use-after-free due to MST port state bypass syzbot reCVE-2025-40298In the Linux kernel, the following vulnerability has been resolved: gve: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes CVE-2025-40299In the Linux kernel, the following vulnerability has been resolved: gve: Implement gettimex64 with -EOPNOTSUPP gve implemented a ptp_clockCVE-2025-40309.8A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been classified as critical. This affects an unknown pCVE-2025-403005.5In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerabilitCVE-2025-403017.6In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hciCVE-2025-403027.8In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid remove_bufs when legacy fileio is active vb2_
CVE-2025-40291: High severity, CVSS 7.8 | Vulnix