CVE-2025-40262

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40262", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.182Z", "datePublished": "2025-12-04T16:08:22.043Z", "dateUpdated": "2026-08-05T12:09:00.219Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:00.219Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: imx_sc_key - fix memory corruption on unload\n\nThis is supposed to be \"priv\" but we accidentally pass \"&priv\" which is\nan address in the stack and so it will lead to memory corruption when\nthe imx_sc_key_action() function is called. Remove the &."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The corrupted teardown is reached through local operations on the platform device (module unload, sysfs driver unbind, or automatic devres unwind on probe failure), not through any network or remote data path. No physical hardware access is needed to initiate it.\nAC:L - The wrong pointer is passed unconditionally on every probe, so the corrupt teardown is fully deterministic with no race to win. Turning the subsequent freed-`priv` notifier/work UAF into a controlled call is standard heap grooming the attacker performs from userspace.\nPR:L - The teardown path is normally entered by driver unbind/module unload, and the identical corrupted action also executes automatically on the probe-failure unwind with no privilege at all; a local unprivileged process supplies the slab contents that the freed `priv` is reallocated into. Scored at the higher-severity option consistent with kernel CNA treatment of devres-lifetime corruption.\nUI:N - No victim action is required \u2014 unbind/unload or probe-failure unwind executes the bad devres action directly, and the resulting stale notifier is invoked by ordinary SCU interrupt activity.\nS:U - The corruption and the resulting use-after-free are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `notifier_block` and `delayed_work` live in freed devm_kzalloc memory that an attacker can reallocate and shape, and the wild pointer reads reused kernel stack memory, giving a path to disclose arbitrary kernel data.\nI:H - `cancel_delayed_work_sync()` performs writes (`atomic_long_set` on `work->data`, timer/worker list manipulation) through an unrelated stale stack address, and the never-unregistered notifier yields an indirect call through a function pointer read from freed slab memory \u2014 both usable for control-flow hijacking.\nA:H - Operating on a garbage `timer_list`/`work_struct` and later walking a notifier chain containing freed memory reliably produces an oops or panic, and the flush path can hang on a bogus work item."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/keyboard/imx_sc_key.c"], "versions": [{"version": "768062fd1284529212daffd360314e9aa93abb62", "lessThan": "3e96803b169dc948847f0fc2bae729a80914eb7b", "status": "affected", "versionType": "git"}, {"version": "768062fd1284529212daffd360314e9aa93abb62", "lessThan": "4ce5218b101205b3425099fe3df88a61b58f9cc2", "status": "affected", "versionType": "git"}, {"version": "768062fd1284529212daffd360314e9aa93abb62", "lessThan": "a155292c3ce722036014da5477ee0e4c87b5e6b3", "status": "affected", "versionType": "git"}, {"version": "768062fd1284529212daffd360314e9aa93abb62", "lessThan": "ca9a08de9b294422376f47ade323d69590dbc6f2", "status": "affected", "versionType": "git"}, {"version": "768062fd1284529212daffd360314e9aa93abb62", "lessThan": "56881294915a6e866d31a46f9bcb5e19167cfbaa", "status": "affected", "versionType": "git"}, {"version": "768062fd1284529212daffd360314e9aa93abb62", "lessThan": "6524a15d33951b18ac408ebbcb9c16e14e21c336", "status": "affected", "versionType": "git"}, {"version": "768062fd1284529212daffd360314e9aa93abb62", "lessThan": "d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/keyboard/imx_sc_key.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.247", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.197", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.118", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.60", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.10", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.247"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.197"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.118"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.17.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e96803b169dc948847f0fc2bae729a80914eb7b"}, {"url": "https://git.kernel.org/stable/c/4ce5218b101205b3425099fe3df88a61b58f9cc2"}, {"url": "https://git.kernel.org/stable/c/a155292c3ce722036014da5477ee0e4c87b5e6b3"}, {"url": "https://git.kernel.org/stable/c/ca9a08de9b294422376f47ade323d69590dbc6f2"}, {"url": "https://git.kernel.org/stable/c/56881294915a6e866d31a46f9bcb5e19167cfbaa"}, {"url": "https://git.kernel.org/stable/c/6524a15d33951b18ac408ebbcb9c16e14e21c336"}, {"url": "https://git.kernel.org/stable/c/d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4"}], "title": "Input: imx_sc_key - fix memory corruption on unload", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:00:13.905Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/input/keyboard/imx_sc_key.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3e96803b169dc948847f0fc2bae729a80914eb7b", "status": "affected", "version": "768062fd1284529212daffd360314e9aa93abb62", "versionType": "git"}, {"lessThan": "4ce5218b101205b3425099fe3df88a61b58f9cc2", "status": "affected", "version": "768062fd1284529212daffd360314e9aa93abb62", "versionType": "git"}, {"lessThan": "a155292c3ce722036014da5477ee0e4c87b5e6b3", "status": "affected", "version": "768062fd1284529212daffd360314e9aa93abb62", "versionType": "git"}, {"lessThan": "ca9a08de9b294422376f47ade323d69590dbc6f2", "status": "affected", "version": "768062fd1284529212daffd360314e9aa93abb62", "versionType": "git"}, {"lessThan": "56881294915a6e866d31a46f9bcb5e19167cfbaa", "status": "affected", "version": "768062fd1284529212daffd360314e9aa93abb62", "versionType": "git"}, {"lessThan": "6524a15d33951b18ac408ebbcb9c16e14e21c336", "status": "affected", "version": "768062fd1284529212daffd360314e9aa93abb62", "versionType": "git"}, {"lessThan": "d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4", "status": "affected", "version": "768062fd1284529212daffd360314e9aa93abb62", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/input/keyboard/imx_sc_key.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.247", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.197", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.159", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.118", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.60", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V4.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: imx_sc_key - fix memory corruption on unload\n\nThis is supposed to be \"priv\" but we accidentally pass \"&priv\" which is\nan address in the stack and so it will lead to memory corruption when\nthe imx_sc_key_action() function is called. Remove the &."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nEntrada: imx_sc_key - soluciona la corrupci\u00f3n de memoria al descargar\n\nSe supone que esto debe ser \u201cpriv\u201d, pero accidentalmente pasamos \u201c&priv\u201d, que es una direcci\u00f3n en la pila y, por lo tanto, conducir\u00e1 a la corrupci\u00f3n de memoria cuando se llama a la funci\u00f3n imx_sc_key_action(). Eliminar el &."}], "id": "CVE-2025-40262", "lastModified": "2026-10-18T18:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-12-04T16:16:20.200", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e96803b169dc948847f0fc2bae729a80914eb7b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ce5218b101205b3425099fe3df88a61b58f9cc2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/56881294915a6e866d31a46f9bcb5e19167cfbaa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6524a15d33951b18ac408ebbcb9c16e14e21c336"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a155292c3ce722036014da5477ee0e4c87b5e6b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ca9a08de9b294422376f47ade323d69590dbc6f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: Input: imx_sc_key - fix memory corruption on unload", "id": "2418894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418894"}, "csaw": false, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nInput: imx_sc_key - fix memory corruption on unload\nThis is supposed to be \"priv\" but we accidentally pass \"&priv\" which is\nan address in the stack and so it will lead to memory corruption when\nthe imx_sc_key_action() function is called. Remove the &."], "name": "CVE-2025-40262", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40262\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40262\nhttps://lore.kernel.org/linux-cve-announce/2025120434-CVE-2025-40262-ba54@gregkh/T"]}

{}