CVE-2025-40052

CVE-2025-40052 is a Linux kernel vulnerability affecting the SMB client's handling of crypto buffers in non-linear memory. Specifically, it occurs when the aead_request buffer, allocated with kvzalloc(), places its internal context in vmalloc'd memory, leading to a kernel BUG when many parallel encrypted SMB reads/writes push task stacks into non-linear virtual address ranges. This bug can be triggered by high-volume encrypted SMB traffic. The vulnerability has a high potential impact, as it can lead to a kernel panic and system instability. The attack vector involves initiating numerous parallel encrypted SMB operations, which could be achieved by an authenticated user with write access to an SMB share. The complexity is moderate, requiring specific conditions related to memory allocation and system load. There is currently no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness or immediate threat.