CVE-2025-40118

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40118", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.168Z", "datePublished": "2025-11-12T10:23:18.179Z", "dateUpdated": "2026-08-05T12:07:55.038Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:55.038Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod\n\nSince commit f7b705c238d1 (\"scsi: pm80xx: Set phy_attached to zero when\ndevice is gone\") UBSAN reports:\n\n UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17\n index 28 is out of range for type 'pm8001_phy [16]'\n\non rmmod when using an expander.\n\nFor a direct attached device, attached_phy contains the local phy id.\nFor a device behind an expander, attached_phy contains the remote phy\nid, not the local phy id.\n\nI.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a\ndevice behind an expander, attached_phy can be much larger than\npm8001_ha->chip->n_phy (depending on the amount of phys of the\nexpander).\n\nE.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the\nports has an expander connected. The expander has 31 phys with phy ids\n0-30.\n\nThe pm8001_ha->phy array only contains the phys of the HBA. It does not\ncontain the phys of the expander. Thus, it is wrong to use attached_phy\nto index the pm8001_ha->phy array for a device behind an expander.\n\nThus, we can only clear phy_attached for devices that are directly\nattached."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The out-of-bounds write is reached through local host operations on the pm80xx SAS HBA \u2014 system suspend (`pm8001_pci_suspend` \u2192 `sas_suspend_ha` \u2192 `sas_suspend_devices`), driver unbind/rmmod, or sysfs device delete \u2014 none of which cross a network boundary. A physical variant exists (hot-unplugging a drive on an expander phy \u2265 16), but the local suspend path is both reachable and more severe.\nAC:L - Once a SAS device is enumerated behind an expander with more than 16 phys \u2014 the standard 24/28/36-phy JBOD backplane configuration described in the commit \u2014 every suspend or removal event deterministically performs the OOB write, with no race to win and no unpredictable state required. The offending index is a stable property of the cabled topology, which the attacker can repeatedly re-trigger.\nPR:L - An unprivileged user with an active local session can invoke system suspend through the default logind/polkit policy, and `sas_suspend_devices()` calls `lldd_dev_gone` for every device on `port->dev_list`, including expander children, driving the OOB write without any capability. No CAP_SYS_MODULE or root is needed on this path.\nUI:N - The attacker triggers suspend or device teardown directly; no separate victim needs to open a file, mount a filesystem, or take any action.\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - A controllable-offset out-of-bounds write into and beyond a large kmalloc'd `pm8001_hba_info` object corrupts adjacent slab objects \u2014 zeroing a length, index, or pointer byte in a neighbouring structure is a standard route to over-read and kernel memory disclosure. Per kernel scoring guidance, memory corruption leveragable for info disclosure is High.\nI:H - This is a direct out-of-bounds write (`phy[idx].phy_attached = 0` with idx up to 127 into a 16-element array), landing in `asd_sas_port` list heads/spinlocks/pointers, the `devices`/`ccb_info` pointers, and ultimately in unrelated heap objects \u2014 a cross-object write primitive with attacker-influenced offset.\nA:H - The bug is confirmed by UBSAN as an array-index-out-of-bounds, and zeroing bytes of live `list_head`s, spinlocks, and kernel pointers reliably produces oopses, corrupted list traversal, or panic on the next use of the clobbered structure."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/pm8001/pm8001_sas.c"], "versions": [{"version": "05b512879eab41faa515b67fa3896d0005e97909", "lessThan": "d94be0a6ae9ade706d4270e740bdb4f79953a7fc", "status": "affected", "versionType": "git"}, {"version": "bc2140c8136200b4437e1abc0fb659968cb9baab", "lessThan": "45acbf154befedd9bc135f5e031fe7855d1e6493", "status": "affected", "versionType": "git"}, {"version": "1d8f9378cb4800c18e20d80ecd605b2b93e87a03", "lessThan": "eef5ef400893f8e3dbb09342583be0cdc716d566", "status": "affected", "versionType": "git"}, {"version": "30e482dfb8f27d22f518695d4bcb5e7f4c6cb08a", "lessThan": "9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582", "status": "affected", "versionType": "git"}, {"version": "a862d24e1fc3ab1b5e5f20878d2898cea346d0ec", "lessThan": "e62251954a128a2d0fcbc19e5fa39e08935bb628", "status": "affected", "versionType": "git"}, {"version": "0f9802f174227f553959422f844eeb9ba72467fe", "lessThan": "9326a1541e1b7ed3efdbab72061b82cf01c6477a", "status": "affected", "versionType": "git"}, {"version": "f7b705c238d1483f0a766e2b20010f176e5c0fb7", "lessThan": "83ced3c206c292458e47c7fac54223abc7141585", "status": "affected", "versionType": "git"}, {"version": "f7b705c238d1483f0a766e2b20010f176e5c0fb7", "lessThan": "251be2f6037fb7ab399f68cd7428ff274133d693", "status": "affected", "versionType": "git"}, {"version": "722026c010fa75bcf9e2373aff1d7930a3d7e3cf", "status": "affected", "versionType": "git"}, {"version": "5.4.293", "lessThan": "5.4.301", "status": "affected", "versionType": "semver"}, {"version": "5.10.237", "lessThan": "5.10.246", "status": "affected", "versionType": "semver"}, {"version": "5.15.181", "lessThan": "5.15.195", "status": "affected", "versionType": "semver"}, {"version": "6.1.136", "lessThan": "6.1.156", "status": "affected", "versionType": "semver"}, {"version": "6.6.89", "lessThan": "6.6.112", "status": "affected", "versionType": "semver"}, {"version": "6.12.26", "lessThan": "6.12.53", "status": "affected", "versionType": "semver"}, {"version": "6.14.5", "lessThan": "6.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/pm8001/pm8001_sas.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.195", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.156", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.112", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.53", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.293", "versionEndExcluding": "5.4.301"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.237", "versionEndExcluding": "5.10.246"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.181", "versionEndExcluding": "5.15.195"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.136", "versionEndExcluding": "6.1.156"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.89", "versionEndExcluding": "6.6.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.26", "versionEndExcluding": "6.12.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d94be0a6ae9ade706d4270e740bdb4f79953a7fc"}, {"url": "https://git.kernel.org/stable/c/45acbf154befedd9bc135f5e031fe7855d1e6493"}, {"url": "https://git.kernel.org/stable/c/eef5ef400893f8e3dbb09342583be0cdc716d566"}, {"url": "https://git.kernel.org/stable/c/9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582"}, {"url": "https://git.kernel.org/stable/c/e62251954a128a2d0fcbc19e5fa39e08935bb628"}, {"url": "https://git.kernel.org/stable/c/9326a1541e1b7ed3efdbab72061b82cf01c6477a"}, {"url": "https://git.kernel.org/stable/c/83ced3c206c292458e47c7fac54223abc7141585"}, {"url": "https://git.kernel.org/stable/c/251be2f6037fb7ab399f68cd7428ff274133d693"}], "title": "scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/scsi/pm8001/pm8001_sas.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d94be0a6ae9ade706d4270e740bdb4f79953a7fc", "status": "affected", "version": "05b512879eab41faa515b67fa3896d0005e97909", "versionType": "git"}, {"lessThan": "45acbf154befedd9bc135f5e031fe7855d1e6493", "status": "affected", "version": "bc2140c8136200b4437e1abc0fb659968cb9baab", "versionType": "git"}, {"lessThan": "eef5ef400893f8e3dbb09342583be0cdc716d566", "status": "affected", "version": "1d8f9378cb4800c18e20d80ecd605b2b93e87a03", "versionType": "git"}, {"lessThan": "9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582", "status": "affected", "version": "30e482dfb8f27d22f518695d4bcb5e7f4c6cb08a", "versionType": "git"}, {"lessThan": "e62251954a128a2d0fcbc19e5fa39e08935bb628", "status": "affected", "version": "a862d24e1fc3ab1b5e5f20878d2898cea346d0ec", "versionType": "git"}, {"lessThan": "9326a1541e1b7ed3efdbab72061b82cf01c6477a", "status": "affected", "version": "0f9802f174227f553959422f844eeb9ba72467fe", "versionType": "git"}, {"lessThan": "83ced3c206c292458e47c7fac54223abc7141585", "status": "affected", "version": "f7b705c238d1483f0a766e2b20010f176e5c0fb7", "versionType": "git"}, {"lessThan": "251be2f6037fb7ab399f68cd7428ff274133d693", "status": "affected", "version": "f7b705c238d1483f0a766e2b20010f176e5c0fb7", "versionType": "git"}, {"status": "affected", "version": "722026c010fa75bcf9e2373aff1d7930a3d7e3cf", "versionType": "git"}, {"lessThan": "5.4.301", "status": "affected", "version": "5.4.293", "versionType": "semver"}, {"lessThan": "5.10.246", "status": "affected", "version": "5.10.237", "versionType": "semver"}, {"lessThan": "5.15.195", "status": "affected", "version": "5.15.181", "versionType": "semver"}, {"lessThan": "6.1.156", "status": "affected", "version": "6.1.136", "versionType": "semver"}, {"lessThan": "6.6.112", "status": "affected", "version": "6.6.89", "versionType": "semver"}, {"lessThan": "6.12.53", "status": "affected", "version": "6.12.26", "versionType": "semver"}, {"lessThan": "6.15", "status": "affected", "version": "6.14.5", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/scsi/pm8001/pm8001_sas.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.301", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.246", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.195", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.156", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.112", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.53", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod\n\nSince commit f7b705c238d1 (\"scsi: pm80xx: Set phy_attached to zero when\ndevice is gone\") UBSAN reports:\n\n UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17\n index 28 is out of range for type 'pm8001_phy [16]'\n\non rmmod when using an expander.\n\nFor a direct attached device, attached_phy contains the local phy id.\nFor a device behind an expander, attached_phy contains the remote phy\nid, not the local phy id.\n\nI.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a\ndevice behind an expander, attached_phy can be much larger than\npm8001_ha->chip->n_phy (depending on the amount of phys of the\nexpander).\n\nE.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the\nports has an expander connected. The expander has 31 phys with phy ids\n0-30.\n\nThe pm8001_ha->phy array only contains the phys of the HBA. It does not\ncontain the phys of the expander. Thus, it is wrong to use attached_phy\nto index the pm8001_ha->phy array for a device behind an expander.\n\nThus, we can only clear phy_attached for devices that are directly\nattached."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: pm80xx: Correcci\u00f3n de \u00edndice de array fuera de l\u00edmites en rmmod\n\nDesde el commit f7b705c238d1 (\u201cscsi: pm80xx: Establecer phy_attached a cero cuando el dispositivo desaparece\u201d) UBSAN informa:\n\n UBSAN: \u00edndice de array fuera de l\u00edmites en drivers/scsi/pm8001/pm8001_sas.c:786:17\n el \u00edndice 28 est\u00e1 fuera de rango para el tipo 'pm8001_phy [16]'\n\nen rmmod cuando se utiliza un expansor.\n\nPara un dispositivo conectado directamente, attached_phy contiene el ID de phy local.\nPara un dispositivo detr\u00e1s de un expansor, attached_phy contiene el ID de phy remoto, no el ID de phy local.\n\nEs decir, mientras que pm8001_ha tendr\u00e1 pm8001_ha->chip->n_phy phys locales, para un dispositivo detr\u00e1s de un expansor, attached_phy puede ser mucho mayor que pm8001_ha->chip->n_phy (dependiendo de la cantidad de phys del expansor).\n\nPor ejemplo, en mi sistema pm8001_ha tiene 8 phys con IDs de phy 0-7. Uno de los puertos tiene un expansor conectado. El expansor tiene 31 phys con IDs de phy 0-30.\n\nEl array pm8001_ha->phy solo contiene los phys del HBA. No contiene los phys del expansor. Por lo tanto, es incorrecto usar attached_phy para indexar el array pm8001_ha->phy para un dispositivo detr\u00e1s de un expansor.\n\nPor lo tanto, solo podemos borrar phy_attached para dispositivos que est\u00e1n conectados directamente."}], "id": "CVE-2025-40118", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-11-12T11:15:41.117", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/251be2f6037fb7ab399f68cd7428ff274133d693"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/45acbf154befedd9bc135f5e031fe7855d1e6493"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83ced3c206c292458e47c7fac54223abc7141585"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9326a1541e1b7ed3efdbab72061b82cf01c6477a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d94be0a6ae9ade706d4270e740bdb4f79953a7fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e62251954a128a2d0fcbc19e5fa39e08935bb628"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eef5ef400893f8e3dbb09342583be0cdc716d566"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod", "id": "2414509", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414509"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod\nSince commit f7b705c238d1 (\"scsi: pm80xx: Set phy_attached to zero when\ndevice is gone\") UBSAN reports:\nUBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17\nindex 28 is out of range for type 'pm8001_phy [16]'\non rmmod when using an expander.\nFor a direct attached device, attached_phy contains the local phy id.\nFor a device behind an expander, attached_phy contains the remote phy\nid, not the local phy id.\nI.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a\ndevice behind an expander, attached_phy can be much larger than\npm8001_ha->chip->n_phy (depending on the amount of phys of the\nexpander).\nE.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the\nports has an expander connected. The expander has 31 phys with phy ids\n0-30.\nThe pm8001_ha->phy array only contains the phys of the HBA. It does not\ncontain the phys of the expander. Thus, it is wrong to use attached_phy\nto index the pm8001_ha->phy array for a device behind an expander.\nThus, we can only clear phy_attached for devices that are directly\nattached."], "name": "CVE-2025-40118", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40118\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40118\nhttps://lore.kernel.org/linux-cve-announce/2025111252-CVE-2025-40118-19e2@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-12T22:12:23.363591+00:00", "updated": "2025-11-12T22:12:23.363615+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}