SB2025102607 - Input validation error in Linux kernel crypto
Published: October 26, 2025 Updated: January 16, 2026
Security Bulletin ID
SB2025102607
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2025-40019)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the essiv_aead_crypt() function in crypto/essiv.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/248ff2797ff52a8cbf86507f9583437443bf7685
- https://git.kernel.org/stable/c/6bb73db6948c2de23e407fe1b7ef94bf02b7529f
- https://git.kernel.org/stable/c/da7afb01ba05577ba3629f7f4824205550644986
- https://git.kernel.org/stable/c/dc4c854a5e7453c465fa73b153eba4ef2a240abe
- https://git.kernel.org/stable/c/df58651968f82344a0ed2afdafd20ecfc55ff548
- https://git.kernel.org/stable/c/f37e7860dc5e94c70b4a3e38a5809181310ea9ac