CVE-2025-40046
published 2025-10-28CVE-2025-40046: In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx request can…
PriorityP342high8.6CVSS 3.1
AVNACLPRNUINSUCLILAH
EPSS
0.33%
25.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix overshooting recv limit
It's reported that sometimes a zcrx request can receive more than was
requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for
all received buffers including frag lists, but then doing recursive
calls to process frag list skbs, which leads to desc->count double
accounting and underflow.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.17.6-1 (forky) | linux 6.17.6-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 6699ec9a23f85f1764183430209c741847c45f12 < 8bcc9eaf1b19f1a7029cba19f6bd4122b40f6c4f | 8bcc9eaf1b19f1a7029cba19f6bd4122b40f6c4f |
| linux | linux | >= 6699ec9a23f85f1764183430209c741847c45f12 < 09cfd3c52ea76f43b3cb15e570aeddf633d65e80 | 09cfd3c52ea76f43b3cb15e570aeddf633d65e80 |
| linux | linux_kernel | >= 0 < 6.17.6-1 | 6.17.6-1 |
| linux | linux_kernel | >= 0 < 6.17.0-14.14 | 6.17.0-14.14 |
| linux | linux_kernel | >= 6.15.0 < 6.17.3 | 6.17.3 |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-oracle | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.activemq/apache-activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-mqtt: MQTT control packet remaining length field is not properly validated (missing fix for CVE-2025
vendor_redhat·2026-04-09·CVSS 5.4
CVE-2026-40046 [MEDIUM] CWE-190 org.apache.activemq/apache-activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-mqtt: MQTT control packet remaining length field is not properly validated (missing fix for CVE-2025
org.apache.activemq/apache-activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-mqtt: MQTT control packet remaining length field is not properly validated (missing fix for CVE-2025-66168)
A flaw was found in Apache ActiveMQ, Apache ActiveMQ All and Apache ActiveMQ MQTT. The fix for CVE-2025-66168 was not applied for 6.0.0+ versions. This exposed the underlying integer overflow/wraparound vulnerability when handling MQTT control packets, causing the broker to misinterpret payloads and leading to unexpected behavior when interacting with non-compliant clients.
Statement: This issue specifically affects Apache ActiveMQ, Apache ActiveMQ All and Apache ActiveMQ MQTT versions from 6.0.0 before 6.2.4. These versions are not shipped in any Red Hat product.
Mitigation: Mitiga
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-02-24
CVE-2025-40175 Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framewor
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-02-17
CVE-2025-40304 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and dr
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-02-17
CVE-2025-68242 Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-02-12
CVE-2025-68242 Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-02-12
CVE-2025-40304 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and dr
Red Hat
kernel: io_uring/zcrx: fix overshooting recv limit
vendor_redhat·2025-10-28
CVE-2025-40046 kernel: io_uring/zcrx: fix overshooting recv limit
kernel: io_uring/zcrx: fix overshooting recv limit
In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix overshooting recv limit
It's reported that sometimes a zcrx request can receive more than was
requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for
all received buffers including frag lists, but then doing recursive
calls to process frag list skbs, which leads to desc->count double
accounting and underflow.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red H
Debian
CVE-2025-40046: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/zc...
vendor_debian·2025
CVE-2025-40046 [LOW] CVE-2025-40046: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/zc...
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.17.6-1)
sid: resolved (fixed in 6.17.6-1)
trixie: resolved
VulDB
Linux Kernel up to 6.17.2 io_zcrx_recv_skb buffer overflow (Nessus ID 271919 / WID-SEC-2025-2431)
vuldb·2026-05-20
CVE-2025-40046 [CRITICAL] Linux Kernel up to 6.17.2 io_zcrx_recv_skb buffer overflow (Nessus ID 271919 / WID-SEC-2025-2431)
A vulnerability marked as critical has been reported in Linux Kernel up to 6.17.2. Affected by this issue is the function io_zcrx_recv_skb. Performing a manipulation results in buffer overflow.
This vulnerability was named CVE-2025-40046. The attack needs to be approached within the local network. There is no available exploit.
It is suggested to upgrade the affected component.
OSV
linux-azure vulnerabilities
osv·2026-02-24
linux-azure vulnerabilities
linux-azure vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers
OSV
linux-oem-6.17 vulnerabilities
osv·2026-02-17
linux-oem-6.17 vulnerabilities
linux-oem-6.17 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device driv
OSV
linux-aws, linux-oracle vulnerabilities
osv·2026-02-17
linux-aws, linux-oracle vulnerabilities
linux-aws, linux-oracle vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto de
OSV
linux-gcp vulnerabilities
osv·2026-02-12
linux-gcp vulnerabilities
linux-gcp vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
OSV
linux, linux-raspi, linux-realtime vulnerabilities
osv·2026-02-12
linux, linux-raspi, linux-realtime vulnerabilities
linux, linux-raspi, linux-realtime vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardwar
GHSA
GHSA-f89g-f269-w35c: In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix overshooting recv limit
It's reported that sometimes a zcrx r
ghsa_unreviewed·2025-10-28
CVE-2025-40046 GHSA-f89g-f269-w35c: In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix overshooting recv limit
It's reported that sometimes a zcrx r
In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix overshooting recv limit
It's reported that sometimes a zcrx request can receive more than was
requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for
all received buffers including frag lists, but then doing recursive
calls to process frag list skbs, which leads to desc->count double
accounting and underflow.
OSV
io_uring/zcrx: fix overshooting recv limit
osv·2025-10-28
CVE-2025-40046 io_uring/zcrx: fix overshooting recv limit
io_uring/zcrx: fix overshooting recv limit
In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix overshooting recv limit
It's reported that sometimes a zcrx request can receive more than was
requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for
all received buffers including frag lists, but then doing recursive
calls to process frag list skbs, which leads to desc->count double
accounting and underflow.
OSV
CVE-2025-40046: In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx req
osv·2025-10-28
CVE-2025-40046 CVE-2025-40046: In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx req
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-40046 org.apache.activemq/apache-activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-mqtt: MQTT control packet remaining length field is not properly validated (missing f
bugzilla·2026-04-09·CVSS 5.4
CVE-2026-40046 [MEDIUM] CVE-2026-40046 org.apache.activemq/apache-activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-mqtt: MQTT control packet remaining length field is not properly validated (missing f
CVE-2026-40046 org.apache.activemq/apache-activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-mqtt: MQTT control packet remaining length field is not properly validated (missing fix for CVE-2025-66168)
Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.
The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.
Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently lat
Bugzilla
CVE-2025-40046 kernel: io_uring/zcrx: fix overshooting recv limit
bugzilla·2025-10-28
CVE-2025-40046 CVE-2025-40046 kernel: io_uring/zcrx: fix overshooting recv limit
CVE-2025-40046 kernel: io_uring/zcrx: fix overshooting recv limit
In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix overshooting recv limit
It's reported that sometimes a zcrx request can receive more than was
requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for
all received buffers including frag lists, but then doing recursive
calls to process frag list skbs, which leads to desc->count double
accounting and underflow.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025102813-CVE-2025-40046-391f@gregkh/T
2025-10-28
Published