GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40214 (GCVE-0-2025-40214)

Vulnerability from cvelistv5 – Published: 2025-12-04 12:38 – Updated: 2026-08-05 12:08
VLAI
Title
af_unix: Initialise scc_index in unix_add_edge().
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consists of three stages. 1) 1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets 1-c. Trigger GC 2) 2-a. Pass sk-A to an embryo sk-B 2-b. Pass sk-X to sk-X 2-c. Trigger GC 3) 3-a. accept() the embryo sk-B 3-b. Pass sk-B to sk-C 3-c. close() the in-flight sk-A 3-d. Trigger GC As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs: unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3 Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC. At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices. unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight. 3-c decrements sk-A's file refcnt to 1. Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X: sk-A -> sk-B (-> sk-C) sk-X -> sk-X This is totally fine. All of them are not yet close()d and should be grouped into different SCCs. However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead. unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !? The problem is that unix_add_edge() does not initialise scc_index. Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c. Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index. This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: adfb68b39b39767d6bfb53e48c4f19c183765686 , < 20003fbb9174121b27bd1da6ebe61542ac4c327d (git)
Affected: d23802221f6755e104606864067c71af8cdb6788 , < 4cd8d755c7d4f515dd9abf483316aca2f1b7b0f3 (git)
Affected: ad081928a8b0f57f269df999a28087fce6f2b6ce , < db81ad20fd8aef7cc7d536c52ee5ea4c1f979128 (git)
Affected: ad081928a8b0f57f269df999a28087fce6f2b6ce , < 1aa7e40ee850c9053e769957ce6541173891204d (git)
Affected: ad081928a8b0f57f269df999a28087fce6f2b6ce , < 60e6489f8e3b086bd1130ad4450a2c112e863791 (git)
Affected: 6.1.141 , < 6.1.159 (semver)
Affected: 6.6.93 , < 6.6.117 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.117 , ≤ 6.6.* (semver)
Unaffected: 6.12.59 , ≤ 6.12.* (semver)
Unaffected: 6.17.9 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens RUGGEDCOM RST2428P Affected: 0 , < V4.0 (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T12:59:56.598Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "20003fbb9174121b27bd1da6ebe61542ac4c327d",
              "status": "affected",
              "version": "adfb68b39b39767d6bfb53e48c4f19c183765686",
              "versionType": "git"
            },
            {
              "lessThan": "4cd8d755c7d4f515dd9abf483316aca2f1b7b0f3",
              "status": "affected",
              "version": "d23802221f6755e104606864067c71af8cdb6788",
              "versionType": "git"
            },
            {
              "lessThan": "db81ad20fd8aef7cc7d536c52ee5ea4c1f979128",
              "status": "affected",
              "version": "ad081928a8b0f57f269df999a28087fce6f2b6ce",
              "versionType": "git"
            },
            {
              "lessThan": "1aa7e40ee850c9053e769957ce6541173891204d",
              "status": "affected",
              "version": "ad081928a8b0f57f269df999a28087fce6f2b6ce",
              "versionType": "git"
            },
            {
              "lessThan": "60e6489f8e3b086bd1130ad4450a2c112e863791",
              "status": "affected",
              "version": "ad081928a8b0f57f269df999a28087fce6f2b6ce",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.159",
              "status": "affected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.117",
              "status": "affected",
              "version": "6.6.93",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "6.1.141",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "6.6.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.59",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Initialise scc_index in unix_add_edge().\n\nQuang Le reported that the AF_UNIX GC could garbage-collect a\nreceive queue of an alive in-flight socket, with a nice repro.\n\nThe repro consists of three stages.\n\n  1)\n    1-a. Create a single cyclic reference with many sockets\n    1-b. close() all sockets\n    1-c. Trigger GC\n\n  2)\n    2-a. Pass sk-A to an embryo sk-B\n    2-b. Pass sk-X to sk-X\n    2-c. Trigger GC\n\n  3)\n    3-a. accept() the embryo sk-B\n    3-b. Pass sk-B to sk-C\n    3-c. close() the in-flight sk-A\n    3-d. Trigger GC\n\nAs of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,\nand unix_walk_scc() groups them into two different SCCs:\n\n  unix_sk(sk-A)-\u003evertex-\u003escc_index = 2 (UNIX_VERTEX_INDEX_START)\n  unix_sk(sk-X)-\u003evertex-\u003escc_index = 3\n\nOnce GC completes, unix_graph_grouped is set to true.\nAlso, unix_graph_maybe_cyclic is set to true due to sk-X\u0027s\ncyclic self-reference, which makes close() trigger GC.\n\nAt 3-b, unix_add_edge() allocates unix_sk(sk-B)-\u003evertex and\nlinks it to unix_unvisited_vertices.\n\nunix_update_graph() is called at 3-a. and 3-b., but neither\nunix_graph_grouped nor unix_graph_maybe_cyclic is changed\nbecause both sk-B\u0027s listener and sk-C are not in-flight.\n\n3-c decrements sk-A\u0027s file refcnt to 1.\n\nSince unix_graph_grouped is true at 3-d, unix_walk_scc_fast()\nis finally called and iterates 3 sockets sk-A, sk-B, and sk-X:\n\n  sk-A -\u003e sk-B (-\u003e sk-C)\n  sk-X -\u003e sk-X\n\nThis is totally fine.  All of them are not yet close()d and\nshould be grouped into different SCCs.\n\nHowever, unix_vertex_dead() misjudges that sk-A and sk-B are\nin the same SCC and sk-A is dead.\n\n  unix_sk(sk-A)-\u003escc_index == unix_sk(sk-B)-\u003escc_index \u003c-- Wrong!\n  \u0026\u0026\n  sk-A\u0027s file refcnt == unix_sk(sk-A)-\u003evertex-\u003eout_degree\n                                       ^-- 1 in-flight count for sk-B\n  -\u003e sk-A is dead !?\n\nThe problem is that unix_add_edge() does not initialise scc_index.\n\nStage 1) is used for heap spraying, making a newly allocated\nvertex have vertex-\u003escc_index == 2 (UNIX_VERTEX_INDEX_START)\nset by unix_walk_scc() at 1-c.\n\nLet\u0027s track the max SCC index from the previous unix_walk_scc()\ncall and assign the max + 1 to a new vertex\u0027s scc_index.\n\nThis way, we can continue to avoid Tarjan\u0027s algorithm while\npreventing misjudgments."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The entire attack is driven by local syscalls on AF_UNIX sockets \u2014 socketpair/connect/accept, sendmsg with SCM_RIGHTS, close \u2014 which is a purely local IPC interface with no remote or adjacent-network reachability.\nAC:L - The attacker controls every stage: the spray allocates and frees the exact same `struct unix_vertex` slab objects that `unix_prepare_fpl()` then reallocates from a LIFO freelist with `scc_index` already set to UNIX_VERTEX_INDEX_START, and the self-referencing socket makes every close() deterministically trigger GC, so no condition lies outside the attacker\u0027s control.\nPR:L - Only an ordinary unprivileged local account is needed \u2014 AF_UNIX socket creation and SCM_RIGHTS fd passing require no capability, no user namespace, and no configuration, and the path is fully reachable from inside containers, sandboxes, and Android app processes.\nUI:N - The attacker\u0027s own process performs all of the socket creation, fd passing, accept(), and close() operations; no action by any other user or victim process is required.\nS:U - The prematurely freed skbs, the dangling `u-\u003eoob_skb`, and the vulnerable GC code all live in the kernel\u0027s own security authority, so this is standard local kernel privilege escalation with no boundary crossing.\nC:H - `unix_stream_recv_urg()` passes the dangling `u-\u003eoob_skb` to `recv_actor()`, copying data from a freed-and-reclaimed skb to userspace, and also reads `oob_skb-\u003eprev`; with the freed object groomed to hold a controlled `-\u003edata`/`-\u003elen`, this yields arbitrary kernel memory disclosure.\nI:H - The same path writes through freed memory \u2014 `UNIXCB(oob_skb).consumed += 1` and `__skb_unlink()` performing `prev-\u003enext = next; next-\u003eprev = prev` with attacker-groomed pointers \u2014 giving a use-after-free unlink write primitive suitable for control-flow hijack, on top of silently destroying a live socket\u0027s queued messages.\nA:H - Freeing an alive socket\u0027s receive queue leaves `u-\u003eoob_skb` and `u-\u003einq_len` inconsistent with a purged queue; subsequent operations dereference freed skbs, reliably producing KASAN splats, oopses, and kernel panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:39.553Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/20003fbb9174121b27bd1da6ebe61542ac4c327d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cd8d755c7d4f515dd9abf483316aca2f1b7b0f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/db81ad20fd8aef7cc7d536c52ee5ea4c1f979128"
        },
        {
          "url": "https://git.kernel.org/stable/c/1aa7e40ee850c9053e769957ce6541173891204d"
        },
        {
          "url": "https://git.kernel.org/stable/c/60e6489f8e3b086bd1130ad4450a2c112e863791"
        },
        {
          "url": "https://mohandacherir.github.io/Qdiv7/posts/unix_new_gc/"
        }
      ],
      "title": "af_unix: Initialise scc_index in unix_add_edge().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40214",
    "datePublished": "2025-12-04T12:38:31.601Z",
    "dateReserved": "2025-04-16T07:20:57.179Z",
    "dateUpdated": "2026-08-05T12:08:39.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40214",
      "date": "2026-09-15",
      "epss": "0.00148",
      "percentile": "0.04324"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40214\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-04T13:15:48.157\",\"lastModified\":\"2026-07-30T06:24:18.343\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naf_unix: Initialise scc_index in unix_add_edge().\\n\\nQuang Le reported that the AF_UNIX GC could garbage-collect a\\nreceive queue of an alive in-flight socket, with a nice repro.\\n\\nThe repro consists of three stages.\\n\\n  1)\\n    1-a. Create a single cyclic reference with many sockets\\n    1-b. close() all sockets\\n    1-c. Trigger GC\\n\\n  2)\\n    2-a. Pass sk-A to an embryo sk-B\\n    2-b. Pass sk-X to sk-X\\n    2-c. Trigger GC\\n\\n  3)\\n    3-a. accept() the embryo sk-B\\n    3-b. Pass sk-B to sk-C\\n    3-c. close() the in-flight sk-A\\n    3-d. Trigger GC\\n\\nAs of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,\\nand unix_walk_scc() groups them into two different SCCs:\\n\\n  unix_sk(sk-A)-\u003evertex-\u003escc_index = 2 (UNIX_VERTEX_INDEX_START)\\n  unix_sk(sk-X)-\u003evertex-\u003escc_index = 3\\n\\nOnce GC completes, unix_graph_grouped is set to true.\\nAlso, unix_graph_maybe_cyclic is set to true due to sk-X\u0027s\\ncyclic self-reference, which makes close() trigger GC.\\n\\nAt 3-b, unix_add_edge() allocates unix_sk(sk-B)-\u003evertex and\\nlinks it to unix_unvisited_vertices.\\n\\nunix_update_graph() is called at 3-a. and 3-b., but neither\\nunix_graph_grouped nor unix_graph_maybe_cyclic is changed\\nbecause both sk-B\u0027s listener and sk-C are not in-flight.\\n\\n3-c decrements sk-A\u0027s file refcnt to 1.\\n\\nSince unix_graph_grouped is true at 3-d, unix_walk_scc_fast()\\nis finally called and iterates 3 sockets sk-A, sk-B, and sk-X:\\n\\n  sk-A -\u003e sk-B (-\u003e sk-C)\\n  sk-X -\u003e sk-X\\n\\nThis is totally fine.  All of them are not yet close()d and\\nshould be grouped into different SCCs.\\n\\nHowever, unix_vertex_dead() misjudges that sk-A and sk-B are\\nin the same SCC and sk-A is dead.\\n\\n  unix_sk(sk-A)-\u003escc_index == unix_sk(sk-B)-\u003escc_index \u003c-- Wrong!\\n  \u0026\u0026\\n  sk-A\u0027s file refcnt == unix_sk(sk-A)-\u003evertex-\u003eout_degree\\n                                       ^-- 1 in-flight count for sk-B\\n  -\u003e sk-A is dead !?\\n\\nThe problem is that unix_add_edge() does not initialise scc_index.\\n\\nStage 1) is used for heap spraying, making a newly allocated\\nvertex have vertex-\u003escc_index == 2 (UNIX_VERTEX_INDEX_START)\\nset by unix_walk_scc() at 1-c.\\n\\nLet\u0027s track the max SCC index from the previous unix_walk_scc()\\ncall and assign the max + 1 to a new vertex\u0027s scc_index.\\n\\nThis way, we can continue to avoid Tarjan\u0027s algorithm while\\npreventing misjudgments.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/unix/garbage.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"adfb68b39b39767d6bfb53e48c4f19c183765686\",\"lessThan\":\"20003fbb9174121b27bd1da6ebe61542ac4c327d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d23802221f6755e104606864067c71af8cdb6788\",\"lessThan\":\"4cd8d755c7d4f515dd9abf483316aca2f1b7b0f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad081928a8b0f57f269df999a28087fce6f2b6ce\",\"lessThan\":\"db81ad20fd8aef7cc7d536c52ee5ea4c1f979128\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad081928a8b0f57f269df999a28087fce6f2b6ce\",\"lessThan\":\"1aa7e40ee850c9053e769957ce6541173891204d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad081928a8b0f57f269df999a28087fce6f2b6ce\",\"lessThan\":\"60e6489f8e3b086bd1130ad4450a2c112e863791\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.141\",\"lessThan\":\"6.1.159\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.93\",\"lessThan\":\"6.6.117\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/unix/garbage.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.159\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.117\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.59\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.9\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1aa7e40ee850c9053e769957ce6541173891204d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/20003fbb9174121b27bd1da6ebe61542ac4c327d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4cd8d755c7d4f515dd9abf483316aca2f1b7b0f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/60e6489f8e3b086bd1130ad4450a2c112e863791\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db81ad20fd8aef7cc7d536c52ee5ea4c1f979128\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://mohandacherir.github.io/Qdiv7/posts/unix_new_gc/\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:47:31+00:00",
      "cve": "CVE-2025-40214",
      "id": "CVE-2025-40214",
      "initial_release_date": "2025-12-04T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: af_unix: Initialise scc_index in unix_add_edge()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40214.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-12T16:47:06Z",
      "cve": "CVE-2025-40214",
      "id": "CVE-2025-40214",
      "initial_release_date": "2025-12-05T00:26:10Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "538",
      "product_status:recommended": "188",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40214",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40214.json",
      "version": "37"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.