CVE-2025-40182

{
  "id": "CVE-2025-40182",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-11-12T22:15:44.963",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: skcipher - Fix reqsize handling\n\nCommit afddce13ce81d (\"crypto: api - Add reqsize to crypto_alg\")\nintroduced cra_reqsize field in crypto_alg struct to replace type\nspecific reqsize fields. It looks like this was introduced specifically\nfor ahash and acomp from the commit description as subsequent commits\nadd necessary changes in these alg frameworks.\n\nHowever, this is being recommended for use in all crypto algs [1]\ninstead of setting reqsize using crypto_*_set_reqsize(). Using\ncra_reqsize in skcipher algorithms, hence, causes memory\ncorruptions and crashes as the underlying functions in the algorithm\nframework have not been updated to set the reqsize properly from\ncra_reqsize. [2]\n\nAdd proper set_reqsize calls in the skcipher init function to\nproperly initialize reqsize for these algorithms in the framework.\n\n[1]: https://lore.kernel.org/linux-crypto/[email protected]/\n[2]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\ncrypto: skcipher - Corrección del manejo de reqsize\n\nEl commit afddce13ce81d (“crypto: API - Add reqsize to crypto_alg”) introdujo el campo cra_reqsize en la estructura crypto_alg para reemplazar los campos reqsize específicos de tipo. Parece que esto se introdujo específicamente para ahash y acomp, según la descripción del commit, ya que los commits posteriores añaden los cambios necesarios en estos frameworks de algoritmos.\n\nSin embargo, esto se está recomendando para su uso en todos los algoritmos criptográficos [1] en lugar de establecer reqsize usando crypto_*_set_reqsize(). El uso de cra_reqsize en algoritmos skcipher, por lo tanto, causa corrupciones de memoria y fallos, ya que las funciones subyacentes en el framework del algoritmo no se han actualizado para establecer reqsize correctamente desde cra_reqsize. [2]\n\nAñadir llamadas set_reqsize adecuadas en la función de inicialización de skcipher para inicializar correctamente reqsize para estos algoritmos en el framework.\n\n[1]: https://lore.kernel.org/linux-crypto/[email protected]/\n[2]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "crypto/skcipher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "afddce13ce81d52a13898fa0700917835c71acd6",
              "lessThan": "f041339d6b9a5a46437f0c48fc7279c92af7a513",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "afddce13ce81d52a13898fa0700917835c71acd6",
              "lessThan": "229c586b5e86979badb7cb0d38717b88a9e95ddd",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "crypto/skcipher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.4",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/229c586b5e86979badb7cb0d38717b88a9e95ddd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f041339d6b9a5a46437f0c48fc7279c92af7a513",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}