CVE-2025-40159 is a vulnerability in the Linux kernel's xsk (XDP Socket) component, specifically related to the validation of userspace-supplied xdp_desc values. Maliciously crafted xdp_desc values, particularly those with large 'len' or low 'addr' values, can bypass validation checks, leading to potential undefined behavior or the queuing of invalid frames for transmission. While not affecting valid XSk applications, this flaw could be exploited for attacks. There is no CVSS score, and its EPSS and FAUCET Risk Score are low, indicating a low likelihood of exploitation and impact. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Linux | Linux | 6.8CNA affecteddefault affected | |
| Linux | Linux | >= 341ac980eab90ac1f6c22ee9f9da83ed9604d899, < 07ca98f906a403637fc5e513a872a50ef1247f3b, >= 341ac980eab90ac1f6c22ee9f9da83ed9604d899, < 1463cd066f32efd56ddfd3ac4e3524200f362980, >= 341ac980eab90ac1f6c22ee9f9da83ed9604d899, < 5b5fffa7c81e55d8c8edf05ad40d811ec7047e21CNA affecteddefault unaffected |
CVSS data has not been published for this CVE.
Linux kernel (Xilinx) vulnerabilities
May 7, 2026Linux kernel (Azure FIPS) vulnerabilities
Apr 9, 2026Linux kernel (Raspberry Pi) vulnerabilities
Apr 1, 2026Linux kernel (Azure) vulnerabilities
Mar 25, 2026Linux kernel (Azure) vulnerabilities
Mar 25, 2026Linux kernel (AWS) vulnerabilities
Mar 23, 2026Linux kernel (Real-time) vulnerabilities
Mar 17, 2026Linux kernel (FIPS) vulnerabilities
Mar 16, 2026Linux kernel (NVIDIA) vulnerabilities
Mar 16, 2026Linux kernel vulnerabilities
Mar 16, 2026Linux kernel (Azure) vulnerabilities
Feb 24, 2026kernel: xsk: Harden userspace-supplied xdp_desc validation
Nov 12, 2025