Every CVE Search/ Get API key

CVE-2025-40214

af_unix: Initialise scc_index in unix_add_edge().

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Initialise scc_index in unix_add_edge().

Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro.

The repro consists of three stages.

1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC

2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC

3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC

As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs:

unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3

Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC.

At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices.

unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight.

3-c decrements sk-A's file refcnt to 1.

Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:

sk-A -> sk-B (-> sk-C) sk-X -> sk-X

This is totally fine. All of them are not yet close()d and should be grouped into different SCCs.

However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead.

unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !?

The problem is that unix_add_edge() does not initialise scc_index.

Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c.

Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index.

This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.19%Up 0.2 points since Dec 5, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.8

af_unix: Initialise scc_index in unix_add_edge().

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Initialise scc_index in unix_add_edge().

Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro.

The repro consists of three stages.

1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC

2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC

3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC

As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs:

unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3

Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC.

At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices.

unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight.

3-c decrements sk-A's file refcnt to 1.

Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:

sk-A -> sk-B (-> sk-C) sk-X -> sk-X

This is totally fine. All of them are not yet close()d and should be grouped into different SCCs.

However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead.

unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !?

The problem is that unix_add_edge() does not initialise scc_index.

Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c.

Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index.

This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.

Record
CVE-2025-40214
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2025-201158 7.8

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Initialise scc_index in unix_add_edge().

Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro.

The repro consists of three stages.

1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC

2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC

3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC

As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs:

unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3

Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC.

At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices.

unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight.

3-c decrements sk-A's file refcnt to 1.

Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:

sk-A -> sk-B (-> sk-C) sk-X -> sk-X

This is totally fine. All of them are not yet close()d and should be grouped into different SCCs.

However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead.

unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !?

The problem is that unix_add_edge() does not initialise scc_index.

Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c.

Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index.

This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.

Record
EUVD-2025-201158
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-g3xr-84mj-fvx6 7.8

In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise...

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Initialise scc_index in unix_add_edge().

Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro.

The repro consists of three stages.

1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC

2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC

3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC

As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs:

unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3

Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC.

At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices.

unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight.

3-c decrements sk-A's file refcnt to 1.

Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:

sk-A -> sk-B (-> sk-C) sk-X -> sk-X

This is totally fine. All of them are not yet close()d and should be grouped into different SCCs.

However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead.

unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !?

The problem is that unix_add_edge() does not initialise scc_index.

Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c.

Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index.

This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.

Record
GHSA-g3xr-84mj-fvx6
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Initialise scc_index in unix_add_edge().

Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro.

The repro consists of three stages.

1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC

2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC

3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC

As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs:

unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3

Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC.

At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices.

unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight.

3-c decrements sk-A's file refcnt to 1.

Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:

sk-A -> sk-B (-> sk-C) sk-X -> sk-X

This is totally fine. All of them are not yet close()d and should be grouped into different SCCs.

However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead.

unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !?

The problem is that unix_add_edge() does not initialise scc_index.

Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c.

Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index.

This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.

Record
CVE-2025-40214
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2025-40214 7.8
Record
BELL-CVE-2025-40214
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

af_unix: Initialise scc_index in unix_add_edge().

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Initialise scc_index in unix_add_edge().

Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro.

The repro consists of three stages.

1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC

2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC

3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC

As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs:

unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3

Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC.

At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices.

unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight.

3-c decrements sk-A's file refcnt to 1.

Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:

sk-A -> sk-B (-> sk-C) sk-X -> sk-X

This is totally fine. All of them are not yet close()d and should be grouped into different SCCs.

However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead.

unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !?

The problem is that unix_add_edge() does not initialise scc_index.

Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c.

Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index.

This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.

Record
CVE-2025-40214
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
Show 24 moreShow less
OSVDEBIAN-CVE-2025-40214 7.8

In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consists of three stages. 1) 1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets 1-c. Trigger GC 2) 2-a. Pass sk-A to an embryo sk-B 2-b. Pass sk-X to sk-X 2-c. Trigger GC 3) 3-a. accept() the embryo sk-B 3-b. Pass sk-B to sk-C 3-c. close() the in-flight sk-A 3-d. Trigger GC As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs: unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3 Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC. At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices. unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight. 3-c decrements sk-A's file refcnt to 1. Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X: sk-A -> sk-B (-> sk-C) sk-X -> sk-X This is totally fine. All of them are not yet close()d and should be grouped into different SCCs. However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead. unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !? The problem is that unix_add_edge() does not initialise scc_index. Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c. Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index. This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.

Record
DEBIAN-CVE-2025-40214
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVASB-A-463258435 No score

In multiple functions of garbage.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Record
ASB-A-463258435
Updated
2026-11-05
OSVMGASA-2026-0017 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.120 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Record
MGASA-2026-0017
Updated
2026-11-02
OSVMGASA-2026-0018 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.120 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record
MGASA-2026-0018
Updated
2026-11-02
OSVopenSUSE-SU-2026:20145-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

  • CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
  • CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
  • CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
  • CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
  • CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
  • CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
  • CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
  • CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
  • CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
  • CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
  • CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
  • CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
  • CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
  • CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
  • CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
  • CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
  • CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
  • CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
  • CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
  • CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
  • CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
  • CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
  • CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
  • CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
  • CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
  • CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
  • CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
  • CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
  • CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
  • CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
  • CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
  • CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
  • CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
  • CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
  • CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
  • CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
  • CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
  • CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
  • CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
  • CVE-2025-40330: bnxt_en: Shutdown FW…
Record
openSUSE-SU-2026:20145-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2025-40214 No score

CVE-2025-40214 in linux - Patched by Root

Root has patched CVE-2025-40214 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2025-40214
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2025-40214 No score

CVE-2025-40214 in linux - Patched by Root

Root has patched CVE-2025-40214 in the linux package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2025-40214
Updated
2026-11-03
OSVSUSE-SU-2026:20207-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

  • CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
  • CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
  • CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
  • CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
  • CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
  • CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
  • CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
  • CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
  • CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
  • CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
  • CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
  • CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
  • CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
  • CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
  • CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
  • CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
  • CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
  • CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
  • CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
  • CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
  • CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
  • CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
  • CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
  • CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
  • CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
  • CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
  • CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
  • CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
  • CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
  • CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
  • CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
  • CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
  • CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
  • CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
  • CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
  • CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
  • CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
  • CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
  • CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
  • CVE-2025-40330: bnxt_en: Shutdown FW…
Record
SUSE-SU-2026:20207-1
Updated
2026-11-02
OSVSUSE-SU-2026:20220-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

  • CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
  • CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
  • CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
  • CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
  • CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
  • CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
  • CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
  • CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
  • CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
  • CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
  • CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
  • CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
  • CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
  • CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
  • CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
  • CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
  • CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
  • CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
  • CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
  • CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
  • CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
  • CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
  • CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
  • CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
  • CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
  • CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
  • CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
  • CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
  • CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
  • CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
  • CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
  • CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
  • CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
  • CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
  • CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
  • CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
  • CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
  • CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
  • CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
  • CVE-2025-40330: bnxt_en: Shutdown FW…
Record
SUSE-SU-2026:20220-1
Updated
2026-11-02
OSVSUSE-SU-2026:20228-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

  • CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
  • CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
  • CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
  • CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
  • CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
  • CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
  • CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
  • CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
  • CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
  • CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
  • CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
  • CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
  • CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
  • CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
  • CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
  • CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
  • CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
  • CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
  • CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
  • CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
  • CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
  • CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
  • CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
  • CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
  • CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
  • CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
  • CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
  • CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
  • CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
  • CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
  • CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
  • CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
  • CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
  • CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
  • CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
  • CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
  • CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
  • CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
  • CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
  • CVE-2025-40330: bnxt_en: Shutdown FW…
Record
SUSE-SU-2026:20228-1
Updated
2026-11-02
OSVSUSE-SU-2026:20564-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

  • CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
  • CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
  • CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
  • CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
  • CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
  • CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
  • CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
  • CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
  • CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
  • CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
  • CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
  • CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
  • CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
  • CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
  • CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
  • CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
  • CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
  • CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
  • CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
  • CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
  • CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
  • CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
  • CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
  • CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
  • CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
  • CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
  • CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
  • CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
  • CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
  • CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
  • CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
  • CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
  • CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
  • CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
  • CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
  • CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
  • CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
  • CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
  • CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
  • CVE-2025-40330: bnxt_en: Shutdown FW…
Record
SUSE-SU-2026:20564-1
Updated
2026-11-02
OSVSUSE-SU-2026:20828-1 No score

Security update for the Linux Kernel RT (Live Patch 3 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20828-1
Updated
2026-11-02
OSVSUSE-SU-2026:20829-1 No score

Security update for the Linux Kernel RT (Live Patch 2 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.7.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40284: Bluetooth: MGMT: cancel mesh send timer when hdev removed (bsc#1257669).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20829-1
Updated
2026-11-02
OSVSUSE-SU-2026:20831-1 No score

Security update for the Linux Kernel RT (Live Patch 0 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247240).
  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40284: Bluetooth: MGMT: cancel mesh send timer when hdev removed (bsc#1257669).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20831-1
Updated
2026-11-02
OSVSUSE-SU-2026:20832-1 No score

Security update for the Linux Kernel RT (Live Patch 1 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.6.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40284: Bluetooth: MGMT: cancel mesh send timer when hdev removed (bsc#1257669).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20832-1
Updated
2026-11-02
OSVSUSE-SU-2026:20837-1 No score

Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20837-1
Updated
2026-11-02
OSVSUSE-SU-2026:20840-1 No score

Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.6.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40284: Bluetooth: MGMT: cancel mesh send timer when hdev removed (bsc#1257669).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20840-1
Updated
2026-11-02
OSVSUSE-SU-2026:20841-1 No score

Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247240).
  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40284: Bluetooth: MGMT: cancel mesh send timer when hdev removed (bsc#1257669).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20841-1
Updated
2026-11-02
OSVSUSE-SU-2026:20842-1 No score

Security update for the Linux Kernel (Live Patch 2 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.7.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40284: Bluetooth: MGMT: cancel mesh send timer when hdev removed (bsc#1257669).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20842-1
Updated
2026-11-02
OSVSUSE-SU-2026:20944-1 No score

Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20944-1
Updated
2026-11-02
OSVSUSE-SU-2026:20945-1 No score

Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.6.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40284: Bluetooth: MGMT: cancel mesh send timer when hdev removed (bsc#1257669).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20945-1
Updated
2026-11-02
OSVSUSE-SU-2026:20946-1 No score

Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247240).
  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40284: Bluetooth: MGMT: cancel mesh send timer when hdev removed (bsc#1257669).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20946-1
Updated
2026-11-02
OSVSUSE-SU-2026:20947-1 No score

Security update for the Linux Kernel (Live Patch 2 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.7.1 fixes various security issues

The following security issues were fixed:

  • CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1255052).
  • CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1255053).
  • CVE-2025-40284: Bluetooth: MGMT: cancel mesh send timer when hdev removed (bsc#1257669).
  • CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255895).
  • CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255378).
  • CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255402).
  • CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256644).
  • CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256624).
Record
SUSE-SU-2026:20947-1
Updated
2026-11-02
OSVUSN-8014-1 No score

linux, linux-aws, linux-azure, linux-gcp, linux-oem-6.17, linux-oracle, linux-raspi, linux-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

  • Cryptographic API;
  • Unix domain sockets; (CVE-2025-40019, CVE-2025-40214)
Record
USN-8014-1
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
:linux_kernel:
Android
 :0 up to :2026-06-05, plus listed versions
Kernel
:2026-06-05
linux-lts
Alpaquita:23
 6.1.158-r0 up to 6.1.159-r0
6.1.159-r0
linux-lts
Alpaquita:25
 6.12.58-r0 up to 6.12.61-r0
6.12.61-r0
linux-lts
Alpaquita:stream
 6.12.92-r1 up to 6.18.35-r1
6.18.35-r1
Kernel
Linux
 before 6.1.159, 6.2.0 up to 6.6.117, 6.7.0 up to 6.12.59, 6.10.0 up to 6.17.9
6.1.1596.6.1176.12.596.17.9
linux
Debian:12
 before 6.1.159-1, plus listed versions
6.1.106-16.1.106-26.1.106-36.1.112-16.1.115-1
Show 40 moreShow less
6.1.119-16.1.123-16.1.124-16.1.128-16.1.129-16.1.133-16.1.135-16.1.137-16.1.139-16.1.140-16.1.147-16.1.148-16.1.153-16.1.158-16.1.27-16.1.37-16.1.38-16.1.38-26.1.38-2~bpo11+16.1.38-36.1.38-46.1.38-4~bpo11+16.1.52-16.1.55-16.1.55-1~bpo11+16.1.64-16.1.66-16.1.67-16.1.69-16.1.69-1~bpo11+16.1.76-16.1.76-1~bpo11+16.1.82-16.1.85-16.1.90-16.1.90-1~bpo11+16.1.94-16.1.94-1~bpo11+16.1.98-16.1.99-1
6.1.159-1
linux
Debian:13
 before 6.12.63-1, plus listed versions
6.12.38-16.12.41-16.12.43-16.12.43-1~bpo12+16.12.48-16.12.57-16.12.57-1~bpo12+16.12.63-1~bpo12+1
6.12.63-1
linux
Debian:14
 before 6.17.9-1, plus listed versions
6.12.100-16.12.101-16.12.105-16.12.107-16.12.111-1
Show 45 moreShow less
6.12.113-16.12.38-16.12.41-16.12.43-16.12.43-1~bpo12+16.12.48-16.12.57-16.12.57-1~bpo12+16.12.63-16.12.63-1~bpo12+16.12.69-16.12.69-1~bpo12+16.12.73-16.12.73-1~bpo12+16.12.74-16.12.74-26.12.74-2~bpo12+16.12.85-16.12.85-1~bpo12+16.12.86-16.12.86-1~bpo12+16.12.88-16.12.88-1~bpo12+16.12.90-16.12.90-1~bpo12+16.12.90-26.12.90-2~bpo12+16.12.94-16.12.94-1~bpo12+16.12.95-16.12.95-1~bpo12+16.12.96-16.13.10-1~exp16.13.11-1~exp16.13.2-1~exp16.13.3-1~exp16.13.4-1~exp16.13.5-1~exp16.13.6-1~exp16.13.7-1~exp16.13.8-1~exp16.13.9-1~exp16.13~rc6-1~exp16.13~rc7-1~exp16.14.3-1~exp1
6.17.9-1
linux-6.1
Debian:11
From an advisory covering 114 CVEs
 before 6.1.159-1~deb11u1, plus listed versions
6.1.106-3~deb11u16.1.106-3~deb11u26.1.106-3~deb11u36.1.112-1~deb11u16.1.119-1~deb11u1
Show 8 moreShow less
6.1.128-1~deb11u16.1.129-1~deb11u16.1.137-1~deb11u16.1.140-1~deb11u16.1.147-1~deb11u16.1.148-1~deb11u16.1.153-1~deb11u16.1.158-1~deb11u1
6.1.159-1~deb11u1
kernel
Mageia:9
From an advisory covering 236 CVEs
 before 6.6.120-1.mga9
6.6.120-1.mga9
Show 72 moreShow less
Affected packages
PackageAffectedFixed
kmod-virtualbox
Mageia:9
From an advisory covering 236 CVEs
 before 7.1.14-14.mga9
7.1.14-14.mga9
kmod-xtables-addons
Mageia:9
From an advisory covering 236 CVEs
 before 3.24-88.mga9
3.24-88.mga9
kernel-linus
Mageia:9
From an advisory covering 236 CVEs
 before 6.6.120-1.mga9
6.6.120-1.mga9
linux
Root:Debian:12
 before 6.1.190-1.aikido.167
6.1.190-1.aikido.167
rootio-linux
Root:Debian:12
 before 6.1.190-1.aikido.167
6.1.190-1.aikido.167
linux
Root:Debian:13
 before 6.12.115-2.aikido.164
6.12.115-2.aikido.164
rootio-linux
Root:Debian:13
 before 6.12.115-2.aikido.164
6.12.115-2.aikido.164
kernel-64kb
SUSE:Linux Micro 6.2
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-default
SUSE:Linux Micro 6.2
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-default-base
SUSE:Linux Micro 6.2
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1.160000.2.6
6.12.0-160000.9.1.160000.2.6
kernel-rt
SUSE:Linux Micro 6.2
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-source
SUSE:Linux Micro 6.2
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-64kb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-azure
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-default
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-default-base
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1.160000.2.6
6.12.0-160000.9.1.160000.2.6
kernel-docs
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-kvmsmall
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-obs-qa
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-source
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-syms
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-zfcpdump
SUSE:Linux Enterprise Server 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-64kb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-azure
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-default
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-default-base
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1.160000.2.6
6.12.0-160000.9.1.160000.2.6
kernel-docs
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-kvmsmall
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-obs-qa
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-source
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-syms
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-zfcpdump
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-default
SUSE:Linux Enterprise High Availability Extension 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-obs-build
SUSE:Linux Micro Extras 6.2
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-syms
SUSE:Linux Micro Extras 6.2
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-livepatch-SLE16-RT_Update_3
SUSE:Linux Micro 6.2
From an advisory covering 7 CVEs
 before 2-160000.1.1
2-160000.1.1
kernel-livepatch-SLE16-RT_Update_2
SUSE:Linux Micro 6.2
From an advisory covering 8 CVEs
 before 3-160000.1.1
3-160000.1.1
kernel-livepatch-SLE16-RT_Update_0
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
 before 6-160000.3.4
6-160000.3.4
kernel-livepatch-SLE16-RT_Update_1
SUSE:Linux Micro 6.2
From an advisory covering 8 CVEs
 before 5-160000.1.1
5-160000.1.1
kernel-livepatch-SLE16_Update_3
SUSE:Linux Micro 6.2
From an advisory covering 7 CVEs
 before 3-160000.1.1
3-160000.1.1
kernel-livepatch-SLE16_Update_1
SUSE:Linux Micro 6.2
From an advisory covering 8 CVEs
 before 6-160000.1.1
6-160000.1.1
kernel-livepatch-SLE16_Update_0
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
 before 8-160000.4.3
8-160000.4.3
kernel-livepatch-SLE16_Update_2
SUSE:Linux Micro 6.2
From an advisory covering 8 CVEs
 before 4-160000.1.1
4-160000.1.1
kernel-livepatch-SLE16_Update_3
SUSE:Linux Enterprise Server 16.0
From an advisory covering 7 CVEs
 before 3-160000.1.1
3-160000.1.1
kernel-livepatch-SLE16_Update_3
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 7 CVEs
 before 3-160000.1.1
3-160000.1.1
kernel-livepatch-SLE16_Update_1
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 6-160000.1.1
6-160000.1.1
kernel-livepatch-SLE16_Update_1
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 6-160000.1.1
6-160000.1.1
kernel-livepatch-SLE16_Update_0
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 8-160000.4.3
8-160000.4.3
kernel-livepatch-SLE16_Update_0
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 8-160000.4.3
8-160000.4.3
kernel-livepatch-SLE16_Update_2
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 4-160000.1.1
4-160000.1.1
kernel-livepatch-SLE16_Update_2
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 4-160000.1.1
4-160000.1.1
linux-oem-6.17
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 6.17.0-1010.10, plus listed versions
6.17.0-1005.56.17.0-1006.66.17.0-1007.76.17.0-1008.86.17.0-1009.9
6.17.0-1010.10
linux
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 6.17.0-12.12, plus listed versions
6.14.0-15.156.15.0-3.36.15.0-4.46.16.0-13.136.16.0-16.16
Show 6 moreShow less
6.17.0-3.36.17.0-4.46.17.0-5.56.17.0-6.66.17.0-7.76.17.0-8.8
6.17.0-12.12
linux-aws
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 6.17.0-1006.6, plus listed versions
6.14.0-1005.56.14.0-1007.7+25.10.26.16.0-1001.16.17.0-1001.16.17.0-1002.26.17.0-1003.36.17.0-1004.46.17.0-1005.5
6.17.0-1006.6
linux-azure
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 6.17.0-1007.7, plus listed versions
6.14.0-1004.46.14.0-1007.7+25.10.16.16.0-1001.16.17.0-1002.26.17.0-1003.36.17.0-1004.46.17.0-1006.6
6.17.0-1007.7
linux-gcp
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 6.17.0-1006.6, plus listed versions
6.14.0-1006.66.14.0-1009.9+25.10.16.16.0-1001.16.17.0-1001.16.17.0-1002.26.17.0-1003.36.17.0-1004.46.17.0-1005.5
6.17.0-1006.6
linux-oracle
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 6.17.0-1006.6, plus listed versions
6.14.0-1005.56.14.0-1007.7+25.10.16.16.0-1001.16.17.0-1001.16.17.0-1002.26.17.0-1003.36.17.0-1005.5
6.17.0-1006.6
linux-raspi
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 6.17.0-1007.7, plus listed versions
6.14.0-1005.56.17.0-1003.36.17.0-1004.46.17.0-1005.56.17.0-1006.6
6.17.0-1007.7
linux-realtime
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 6.17.0-1005.6, plus listed versions
6.14.0-1002.26.17.0-1001.26.17.0-1002.36.17.0-1003.46.17.0-1004.5
6.17.0-1005.6
dtb-aarch64
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-64kb
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-azure
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-default
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-default-base
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1.160000.2.6
6.12.0-160000.9.1.160000.2.6
kernel-docs
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-kvmsmall
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-obs-build
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-obs-qa
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-rt
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-source
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-syms
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1
kernel-zfcpdump
openSUSE:Leap 16.0
From an advisory covering 215 CVEs
 before 6.12.0-160000.9.1
6.12.0-160000.9.1

History

History
RecordedChangedSources
affectedOSV
affected, aliases, facts, referencesOSV
affected, aliases, referencesOSV
affectedOSV
first indexedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-40214 is a high vulnerability (CVSS 7.8) in Linux, published December 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in :linux_kernel: :2026-06-05.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 32 versions, 308 references and the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open