CVE-2025-40214
published 2025-12-04CVE-2025-40214: In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
4.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Initialise scc_index in unix_add_edge().
Quang Le reported that the AF_UNIX GC could garbage-collect a
receive queue of an alive in-flight socket, with a nice repro.
The repro consists of three stages.
1)
1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC
2)
2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC
3)
3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,
and unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)
unix_sk(sk-X)->vertex->scc_index = 3
Once GC completes, unix_graph_grouped is set to true.
Also, unix_graph_maybe_cyclic is set to true due to sk-X's
cyclic self-reference, which makes close() trigger GC.
At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and
links it to unix_unvisited_vertices.
unix_update_graph() is called at 3-a. and 3-b., but neither
unix_graph_grouped nor unix_graph_maybe_cyclic is changed
because both sk-B's listener and sk-C are not in-flight.
3-c decrements sk-A's file refcnt to 1.
Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast()
is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:
sk-A -> sk-B (-> sk-C)
sk-X -> sk-X
This is totally fine. All of them are not yet close()d and
should be grouped into different SCCs.
However, unix_vertex_dead() misjudges that sk-A and sk-B are
in the same SCC and sk-A is dead.
unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index vertex->out_degree
^-- 1 in-flight count for sk-B
-> sk-A is dead !?
The problem is that unix_add_edge() does not initialise scc_index.
Stage 1) is used for heap spraying, making a newly allocated
vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START)
set by unix_walk_scc() at 1-c.
Let's track the max SCC i
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.159-1 (bookworm) | linux 6.1.159-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.159-1 (bookworm) | linux 6.1.159-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 6.1.141 < 6.1.159 | 6.1.159 |
| linux | linux | >= 6.6.93 < 6.6.117 | 6.6.117 |
| linux | linux | >= ad081928a8b0f57f269df999a28087fce6f2b6ce < db81ad20fd8aef7cc7d536c52ee5ea4c1f979128 | db81ad20fd8aef7cc7d536c52ee5ea4c1f979128 |
| linux | linux | >= ad081928a8b0f57f269df999a28087fce6f2b6ce < 1aa7e40ee850c9053e769957ce6541173891204d | 1aa7e40ee850c9053e769957ce6541173891204d |
| linux | linux | >= ad081928a8b0f57f269df999a28087fce6f2b6ce < 60e6489f8e3b086bd1130ad4450a2c112e863791 | 60e6489f8e3b086bd1130ad4450a2c112e863791 |
| linux | linux | >= adfb68b39b39767d6bfb53e48c4f19c183765686 < 20003fbb9174121b27bd1da6ebe61542ac4c327d | 20003fbb9174121b27bd1da6ebe61542ac4c327d |
| linux | linux | >= d23802221f6755e104606864067c71af8cdb6788 < 4cd8d755c7d4f515dd9abf483316aca2f1b7b0f3 | 4cd8d755c7d4f515dd9abf483316aca2f1b7b0f3 |
| linux | linux_kernel | >= 0 < 6.1.159-1 | 6.1.159-1 |
| linux | linux_kernel | >= 0 < 6.12.63-1 | 6.12.63-1 |
| linux | linux_kernel | >= 0 < 6.17.9-1 | 6.17.9-1 |
| linux | linux_kernel | >= 0 < 6.1.159 | 6.1.159 |
| linux | linux_kernel | >= 0 < 6.17.0-12.12 | 6.17.0-12.12 |
| linux | linux_kernel | >= 6.10.0 < 6.17.9 | 6.17.9 |
| linux | linux_kernel | >= 6.2.0 < 6.6.117 | 6.6.117 |
| linux | linux_kernel | >= 6.7.0 < 6.12.59 | 6.12.59 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu7.8HIGH
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux, linux-aws, linux-azure, linux-gcp, linux-oem-6.17, linux-oracle, linux-raspi, linux-realtime vulnerabilities
osv·2026-02-04
CVE-2025-40019 linux, linux-aws, linux-azure, linux-gcp, linux-oem-6.17, linux-oracle, linux-raspi, linux-realtime vulnerabilities
linux, linux-aws, linux-azure, linux-gcp, linux-oem-6.17, linux-oracle, linux-raspi, linux-realtime vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Unix domain sockets;
(CVE-2025-40019, CVE-2025-40214)
OSV
CVE-2025-40214: In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge()
osv·2025-12-04
CVE-2025-40214 CVE-2025-40214: In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge()
In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consists of three stages. 1) 1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets 1-c. Trigger GC 2) 2-a. Pass sk-A to an embryo sk-B 2-b. Pass sk-X to sk-X 2-c. Trigger GC 3) 3-a. accept() the embryo sk-B 3-b. Pass sk-B to sk-C 3-c. close() the in-flight sk-A 3-d. Trigger GC As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs: unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3 Once GC completes, un
GHSA
GHSA-g3xr-84mj-fvx6: In the Linux kernel, the following vulnerability has been resolved:
af_unix: Initialise scc_index in unix_add_edge()
ghsa_unreviewed·2025-12-04
CVE-2025-40214 GHSA-g3xr-84mj-fvx6: In the Linux kernel, the following vulnerability has been resolved:
af_unix: Initialise scc_index in unix_add_edge()
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Initialise scc_index in unix_add_edge().
Quang Le reported that the AF_UNIX GC could garbage-collect a
receive queue of an alive in-flight socket, with a nice repro.
The repro consists of three stages.
1)
1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC
2)
2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC
3)
3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,
and unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)
unix_sk(sk-X)->vertex->scc_index = 3
Once GC comp
OSV
af_unix: Initialise scc_index in unix_add_edge().
osv·2025-12-04
CVE-2025-40214 af_unix: Initialise scc_index in unix_add_edge().
af_unix: Initialise scc_index in unix_add_edge().
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Initialise scc_index in unix_add_edge().
Quang Le reported that the AF_UNIX GC could garbage-collect a
receive queue of an alive in-flight socket, with a nice repro.
The repro consists of three stages.
1)
1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC
2)
2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC
3)
3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,
and unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2026-03-04·CVSS 7.8
CVE-2025-40214 [HIGH] Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
In the Linux kernel, the following vulnerability has been
resolved: smb: client: fix UAF in async decryption Doing an async
decryption (large read) crashes with a slab-use-after-free way down in the
crypto API.
In the Linux kernel, the following vulnerability has been
resolved: padata: avoid UAF for reorder_work Although the previous patch
can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF
issue for reorder_work.
In the Linux kernel, the following vulnerability has been
resolved: exfat: fix random stack corruption after get_block When get_block
is called with a buffer_head allocated on the stack, such as
do_mpage_readpage, stack corruption due to buffer_head UAF may o
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-02-04
CVE-2025-40019 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Unix domain sockets;
(CVE-2025-40019, CVE-2025-40214)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-vi
Red Hat
kernel: af_unix: Initialise scc_index in unix_add_edge()
vendor_redhat·2025-12-04·CVSS 5.8
CVE-2025-40214 [MEDIUM] CWE-908 kernel: af_unix: Initialise scc_index in unix_add_edge()
kernel: af_unix: Initialise scc_index in unix_add_edge()
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Initialise scc_index in unix_add_edge().
Quang Le reported that the AF_UNIX GC could garbage-collect a
receive queue of an alive in-flight socket, with a nice repro.
The repro consists of three stages.
1)
1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC
2)
2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC
3)
3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,
and unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)
Debian
CVE-2025-40214: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: In...
vendor_debian·2025
CVE-2025-40214 CVE-2025-40214: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: In...
In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consists of three stages. 1) 1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets 1-c. Trigger GC 2) 2-a. Pass sk-A to an embryo sk-B 2-b. Pass sk-X to sk-X 2-c. Trigger GC 3) 3-a. accept() the embryo sk-B 3-b. Pass sk-B to sk-C 3-c. close() the in-flight sk-A 3-d. Trigger GC As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs: unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3 Once GC completes, un
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1aa7e40ee850c9053e769957ce6541173891204dhttps://git.kernel.org/stable/c/20003fbb9174121b27bd1da6ebe61542ac4c327dhttps://git.kernel.org/stable/c/4cd8d755c7d4f515dd9abf483316aca2f1b7b0f3https://git.kernel.org/stable/c/60e6489f8e3b086bd1130ad4450a2c112e863791https://git.kernel.org/stable/c/db81ad20fd8aef7cc7d536c52ee5ea4c1f979128https://mohandacherir.github.io/Qdiv7/posts/unix_new_gc/https://cert-portal.siemens.com/productcert/html/ssa-253495.html
2025-12-04
Published