CVE-2025-40124

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40124", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.169Z", "datePublished": "2025-11-12T10:23:19.861Z", "dateUpdated": "2026-08-05T12:07:57.197Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:57.197Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III\n\nAnthony Yznaga tracked down that a BUG_ON in ext4 code with large folios\nenabled resulted from copy_from_user() returning impossibly large values\ngreater than the size to be copied. This lead to __copy_from_iter()\nreturning impossible values instead of the actual number of bytes it was\nable to copy.\n\nThe BUG_ON has been reported in\nhttps://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de\n\nThe referenced commit introduced exception handlers on user-space memory\nreferences in copy_from_user and copy_to_user. These handlers return from\nthe respective function and calculate the remaining bytes left to copy\nusing the current register contents. The exception handlers expect that\n%o2 has already been masked during the bulk copy loop, but the masking was\nperformed after that loop. This will fix the return value of copy_from_user\nand copy_to_user in the faulting case. The behaviour of memcpy stays\nunchanged."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The fault must occur inside a `copy_{from,to}_user()` on a buffer in the attacker's own address space, which requires local `mmap`/`munmap`/`mprotect` control plus a local syscall entry (write(2), ioctl(2), etc.). No remote peer can cause a user-copy fault at a chosen offset.\nAC:L - Every precondition is deterministic and attacker-chosen: length \u2265 192 selects the VIS block-copy path, dst/src alignment is controllable, and the fault offset is placed exactly by unmapping or PROT_NONE-ing a page of the source buffer. There is no race and no dependence on unpredictable memory layout.\nPR:L - Any unprivileged local user can trigger this with ordinary `write(2)`/`read(2)`/`ioctl(2)` plus `mmap`/`munmap`; no capability, namespace trick, or privileged device access is required.\nUI:N - The attacking process performs the entire sequence itself \u2014 mapping the partially-valid buffer and issuing the syscall. No victim action is involved.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The over-reported count underflows `iterate_iovec()`/`iterate_ubuf()` accounting, causing the iterator to walk past the end of the kernel iovec array and treat arbitrary kernel memory as iovec descriptors, and the resulting heap corruption primitive can be leveraged for kernel memory disclosure.\nI:H - `_inline_copy_from_user()`'s tail `memset(to + (n - res), 0, res)` with `res > n` wraps the pointer and zeroes up to ~n bytes of kernel heap memory *before* the destination buffer \u2014 an attacker-sized out-of-bounds write (4 KB underflow for a 4 KB copy) into adjacent slab objects, a well-known privilege-escalation primitive.\nA:H - The bug was reported as a hard `BUG_ON` panic in ext4's large-folio write path, and the `size_t` underflow of `iter->count`/`len` also drives runaway iteration loops \u2014 both are full kernel denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/sparc/lib/U3memcpy.S"], "versions": [{"version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "fdd43fe6d286f27b826572457a89c926f97e2d3a", "status": "affected", "versionType": "git"}, {"version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "1198077606aeffb102587c6ea079ce99641c99d4", "status": "affected", "versionType": "git"}, {"version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "1857cdca12c4aff58bf26a7005a4d02850c29927", "status": "affected", "versionType": "git"}, {"version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "91eda032eb16e5d2be27c95584665bc555bb5a90", "status": "affected", "versionType": "git"}, {"version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e", "status": "affected", "versionType": "git"}, {"version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "5ef9c94d7110e90260c06868cf1dcf899b9f25ee", "status": "affected", "versionType": "git"}, {"version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "e50377c6b3f278c9f3ef017ffce17f5fcc9dace4", "status": "affected", "versionType": "git"}, {"version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "47b49c06eb62504075f0f2e2227aee2e2c2a58b3", "status": "affected", "versionType": "git"}, {"version": "1c7e17b1c4d60cc5aa575460f7efb73686dd3b39", "status": "affected", "versionType": "git"}, {"version": "ac663c54f40b2830b1ca32d1ae9d683fe248b14c", "status": "affected", "versionType": "git"}, {"version": "4.4.34", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.8.10", "lessThan": "4.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/sparc/lib/U3memcpy.S"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.195", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.156", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.112", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.53", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.4.301"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.246"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.195"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.156"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fdd43fe6d286f27b826572457a89c926f97e2d3a"}, {"url": "https://git.kernel.org/stable/c/1198077606aeffb102587c6ea079ce99641c99d4"}, {"url": "https://git.kernel.org/stable/c/1857cdca12c4aff58bf26a7005a4d02850c29927"}, {"url": "https://git.kernel.org/stable/c/91eda032eb16e5d2be27c95584665bc555bb5a90"}, {"url": "https://git.kernel.org/stable/c/dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e"}, {"url": "https://git.kernel.org/stable/c/5ef9c94d7110e90260c06868cf1dcf899b9f25ee"}, {"url": "https://git.kernel.org/stable/c/e50377c6b3f278c9f3ef017ffce17f5fcc9dace4"}, {"url": "https://git.kernel.org/stable/c/47b49c06eb62504075f0f2e2227aee2e2c2a58b3"}], "title": "sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/sparc/lib/U3memcpy.S"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fdd43fe6d286f27b826572457a89c926f97e2d3a", "status": "affected", "version": "ee841d0aff649164080e445e84885015958d8ff4", "versionType": "git"}, {"lessThan": "1198077606aeffb102587c6ea079ce99641c99d4", "status": "affected", "version": "ee841d0aff649164080e445e84885015958d8ff4", "versionType": "git"}, {"lessThan": "1857cdca12c4aff58bf26a7005a4d02850c29927", "status": "affected", "version": "ee841d0aff649164080e445e84885015958d8ff4", "versionType": "git"}, {"lessThan": "91eda032eb16e5d2be27c95584665bc555bb5a90", "status": "affected", "version": "ee841d0aff649164080e445e84885015958d8ff4", "versionType": "git"}, {"lessThan": "dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e", "status": "affected", "version": "ee841d0aff649164080e445e84885015958d8ff4", "versionType": "git"}, {"lessThan": "5ef9c94d7110e90260c06868cf1dcf899b9f25ee", "status": "affected", "version": "ee841d0aff649164080e445e84885015958d8ff4", "versionType": "git"}, {"lessThan": "e50377c6b3f278c9f3ef017ffce17f5fcc9dace4", "status": "affected", "version": "ee841d0aff649164080e445e84885015958d8ff4", "versionType": "git"}, {"lessThan": "47b49c06eb62504075f0f2e2227aee2e2c2a58b3", "status": "affected", "version": "ee841d0aff649164080e445e84885015958d8ff4", "versionType": "git"}, {"status": "affected", "version": "1c7e17b1c4d60cc5aa575460f7efb73686dd3b39", "versionType": "git"}, {"status": "affected", "version": "ac663c54f40b2830b1ca32d1ae9d683fe248b14c", "versionType": "git"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.34", "versionType": "semver"}, {"lessThan": "4.9", "status": "affected", "version": "4.8.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/sparc/lib/U3memcpy.S"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.301", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.246", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.195", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.156", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.112", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.53", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III\n\nAnthony Yznaga tracked down that a BUG_ON in ext4 code with large folios\nenabled resulted from copy_from_user() returning impossibly large values\ngreater than the size to be copied. This lead to __copy_from_iter()\nreturning impossible values instead of the actual number of bytes it was\nable to copy.\n\nThe BUG_ON has been reported in\nhttps://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de\n\nThe referenced commit introduced exception handlers on user-space memory\nreferences in copy_from_user and copy_to_user. These handlers return from\nthe respective function and calculate the remaining bytes left to copy\nusing the current register contents. The exception handlers expect that\n%o2 has already been masked during the bulk copy loop, but the masking was\nperformed after that loop. This will fix the return value of copy_from_user\nand copy_to_user in the faulting case. The behaviour of memcpy stays\nunchanged."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsparc: corregir el informe preciso de excepciones en copy_{from_to}_user para UltraSPARC III\n\nAnthony Yznaga descubri\u00f3 que un BUG_ON en el c\u00f3digo ext4 con folios grandes habilitados resultaba de que copy_from_user() devolviera valores imposiblemente grandes, mayores que el tama\u00f1o a copiar. Esto llev\u00f3 a que __copy_from_iter() devolviera valores imposibles en lugar del n\u00famero real de bytes que pudo copiar.\n\nEl BUG_ON ha sido reportado en https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de\n\nEl commit referenciado introdujo manejadores de excepciones en referencias de memoria de espacio de usuario en copy_from_user y copy_to_user. Estos manejadores regresan de la funci\u00f3n respectiva y calculan los bytes restantes por copiar utilizando el contenido actual del registro. Los manejadores de excepciones esperan que %o2 ya haya sido enmascarado durante el bucle de copia masiva, pero el enmascaramiento se realiz\u00f3 despu\u00e9s de ese bucle. Esto corregir\u00e1 el valor de retorno de copy_from_user y copy_to_user en el caso de fallo. El comportamiento de memcpy permanece sin cambios."}], "id": "CVE-2025-40124", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-11-12T11:15:41.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1198077606aeffb102587c6ea079ce99641c99d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1857cdca12c4aff58bf26a7005a4d02850c29927"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47b49c06eb62504075f0f2e2227aee2e2c2a58b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5ef9c94d7110e90260c06868cf1dcf899b9f25ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/91eda032eb16e5d2be27c95584665bc555bb5a90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e50377c6b3f278c9f3ef017ffce17f5fcc9dace4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fdd43fe6d286f27b826572457a89c926f97e2d3a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III", "id": "2414499", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414499"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III\nAnthony Yznaga tracked down that a BUG_ON in ext4 code with large folios\nenabled resulted from copy_from_user() returning impossibly large values\ngreater than the size to be copied. This lead to __copy_from_iter()\nreturning impossible values instead of the actual number of bytes it was\nable to copy.\nThe BUG_ON has been reported in\nhttps://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de\nThe referenced commit introduced exception handlers on user-space memory\nreferences in copy_from_user and copy_to_user. These handlers return from\nthe respective function and calculate the remaining bytes left to copy\nusing the current register contents. The exception handlers expect that\n%o2 has already been masked during the bulk copy loop, but the masking was\nperformed after that loop. This will fix the return value of copy_from_user\nand copy_to_user in the faulting case. The behaviour of memcpy stays\nunchanged."], "name": "CVE-2025-40124", "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40124\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40124\nhttps://lore.kernel.org/linux-cve-announce/2025111253-CVE-2025-40124-5006@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-12T22:12:33.104696+00:00", "updated": "2025-11-12T22:12:33.104720+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}