CVE-2025-40253

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again. Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'. Bug detected by the clang static analyzer.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/06f1dd1de0d33dbfbd2e1fc9fc57d8895f730de2
https://git.kernel.org/stable/c/3b177b2ded563df16f6d5920671ffcfe5915d472
https://git.kernel.org/stable/c/43096dab8cc60fc39133205fd149a54d3acebea8
https://git.kernel.org/stable/c/6bf8ccaabce8cebb6cb1f255c93d0acdfe95c17a
https://git.kernel.org/stable/c/7616e2eee679746d526c7f5befd4eedb995935b5
https://git.kernel.org/stable/c/7ff76f8dc6b550f8d16487bf3cebc278be720b5c
https://git.kernel.org/stable/c/b9dbfb1b5699f9f1e4991f96741bdf9047147589
https://git.kernel.org/stable/c/da02a1824884d6c84c5e5b5ac373b0c9e3288ec2

Configurations

No configuration.

History

30 Jul 2026, 06:24

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8

06 Dec 2025, 22:15

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/43096dab8cc60fc39133205fd149a54d3acebea8 - () https://git.kernel.org/stable/c/6bf8ccaabce8cebb6cb1f255c93d0acdfe95c17a - () https://git.kernel.org/stable/c/7616e2eee679746d526c7f5befd4eedb995935b5 -

04 Dec 2025, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-04 16:16

Updated : 2026-07-30 06:24

NVD link : CVE-2025-40253

Mitre link : CVE-2025-40253

CVE.ORG link : CVE-2025-40253

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-40253", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "467ddbbe7e749d558f13e640f50f546149c930b3", "lessThan": "06f1dd1de0d33dbfbd2e1fc9fc57d8895f730de2", "versionType": "git"}, {"status": "affected", "version": "4d3c6d741816539b57fa1110c3f765a8c176d7b4", "lessThan": "6bf8ccaabce8cebb6cb1f255c93d0acdfe95c17a", "versionType": "git"}, {"status": "affected", "version": "2bd57101c3ecf3f8c0da1d26c2b6ad511adc6d50", "lessThan": "7616e2eee679746d526c7f5befd4eedb995935b5", "versionType": "git"}, {"status": "affected", "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a", "lessThan": "43096dab8cc60fc39133205fd149a54d3acebea8", "versionType": "git"}, {"status": "affected", "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a", "lessThan": "3b177b2ded563df16f6d5920671ffcfe5915d472", "versionType": "git"}, {"status": "affected", "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a", "lessThan": "b9dbfb1b5699f9f1e4991f96741bdf9047147589", "versionType": "git"}, {"status": "affected", "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a", "lessThan": "7ff76f8dc6b550f8d16487bf3cebc278be720b5c", "versionType": "git"}, {"status": "affected", "version": "0c0b20587b9f25a2ad14db7f80ebe49bdf29920a", "lessThan": "da02a1824884d6c84c5e5b5ac373b0c9e3288ec2", "versionType": "git"}, {"status": "affected", "version": "36933de59f67029e5739a98393891f9b94f27e0f", "versionType": "git"}, {"status": "affected", "version": "d886b4292a1c5b4facdb2dfdc31f0fecc71df898", "versionType": "git"}, {"status": "affected", "version": "4c9ba0fed125deba8416b995b0c274b0804c0c24", "versionType": "git"}, {"status": "affected", "version": "ea0053af5dab4d63a9c44563973fb2f3bfd9eb2b", "versionType": "git"}, {"status": "affected", "version": "5.4.195", "lessThan": "5.4.302", "versionType": "semver"}, {"status": "affected", "version": "5.10.117", "lessThan": "5.10.247", "versionType": "semver"}, {"status": "affected", "version": "5.15.41", "lessThan": "5.15.197", "versionType": "semver"}, {"status": "affected", "version": "4.9.315", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.14.280", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.244", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.17.9", "lessThan": "5.18", "versionType": "semver"}], "programFiles": ["drivers/s390/net/ctcm_mpc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.302", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.247", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.197", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.159", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.118", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.60", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.10", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/s390/net/ctcm_mpc.c"], "defaultStatus": "affected"}]}], "published": "2025-12-04T16:16:18.937", "references": [{"url": "https://git.kernel.org/stable/c/06f1dd1de0d33dbfbd2e1fc9fc57d8895f730de2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3b177b2ded563df16f6d5920671ffcfe5915d472", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/43096dab8cc60fc39133205fd149a54d3acebea8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6bf8ccaabce8cebb6cb1f255c93d0acdfe95c17a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7616e2eee679746d526c7f5befd4eedb995935b5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7ff76f8dc6b550f8d16487bf3cebc278be720b5c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b9dbfb1b5699f9f1e4991f96741bdf9047147589", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/da02a1824884d6c84c5e5b5ac373b0c9e3288ec2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ctcm: Fix double-kfree\n\nThe function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally\nfrom function 'ctcmpc_unpack_skb'. It frees passed mpcginfo.\nAfter that a call to function 'kfree' in function 'ctcmpc_unpack_skb'\nfrees it again.\n\nRemove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'.\n\nBug detected by the clang static analyzer."}], "lastModified": "2026-07-30T06:24:22.863", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}