Use-after-free in Linux kernel - CVE-2025-40202

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU118477

Use-after-free in Linux kernel - CVE-2025-40202

Published: November 13, 2025


Vulnerability identifier: #VU118477
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-40202
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the deliver_response(), ipmi_set_gets_events(), i_ipmi_request(), handle_ipmb_get_msg_cmd(), handle_ipmb_direct_rcv_cmd(), handle_lan_get_msg_cmd(), handle_oem_get_msg_cmd(), handle_read_event_rsp(), smi_work() and free_recv_msg() functions in drivers/char/ipmi/ipmi_msghandler.c. A local user can escalate privileges on the system.


Affected software

Linux kernel
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Live Patching
Legacy Module
Development Tools Module
Public Cloud Module
Basesystem Module
SUSE Real Time Module
openSUSE Leap
Ubuntu
openEuler
kernel-livepatch-6_4_0-150600_23_87-default
kernel-livepatch-6_4_0-150600_23_87-default-debuginfo
kernel-livepatch-SLE15-SP6_Update_20-debugsource
kernel-livepatch-6_4_0-150700_7_31-rt-debuginfo
kernel-livepatch-6_4_0-150700_7_31-rt
kernel-livepatch-SLE15-SP7-RT_Update_9-debugsource
kernel-livepatch-6_4_0-150700_53_31-default
kernel-livepatch-SLE15-SP7_Update_9-debugsource
kernel-livepatch-6_4_0-150700_53_31-default-debuginfo
ocfs2-kmp-default-debuginfo
kernel-obs-build-debugsource
dlm-kmp-default-debuginfo
kernel-default-debugsource
kernel-default-optional
cluster-md-kmp-default-debuginfo
kernel-syms
kselftests-kmp-default
kselftests-kmp-default-debuginfo
cluster-md-kmp-default
gfs2-kmp-default-debuginfo
kernel-default-devel
kernel-obs-qa
kernel-default-optional-debuginfo
kernel-default
kernel-default-livepatch-devel
kernel-kvmsmall
kernel-default-extra
kernel-debug-debugsource
kernel-default-vdso-debuginfo
kernel-default-vdso
kernel-kvmsmall-vdso-debuginfo
kernel-kvmsmall-vdso
kernel-debug-vdso-debuginfo
kernel-debug-vdso
kernel-kvmsmall-devel
kernel-kvmsmall-devel-debuginfo
kernel-kvmsmall-debuginfo
kernel-kvmsmall-debugsource
kernel-default-extra-debuginfo
ocfs2-kmp-default
reiserfs-kmp-default
dlm-kmp-default
kernel-default-debuginfo
reiserfs-kmp-default-debuginfo
kernel-default-livepatch
kernel-obs-build
kernel-default-devel-debuginfo
kernel-zfcpdump-debuginfo
gfs2-kmp-default
ocfs2-kmp-64kb-debuginfo
dtb-lg
dtb-renesas
cluster-md-kmp-64kb-debuginfo
dtb-apm
dtb-altera
dtb-amd
reiserfs-kmp-64kb-debuginfo
dtb-sprd
kernel-64kb-extra-debuginfo
dtb-allwinner
dtb-socionext
dlm-kmp-64kb
dtb-cavium
kernel-64kb-extra
kernel-64kb-optional
dtb-apple
ocfs2-kmp-64kb
dtb-exynos
dtb-xilinx
dlm-kmp-64kb-debuginfo
kselftests-kmp-64kb
reiserfs-kmp-64kb
dtb-broadcom
kernel-debug-debuginfo
kernel-zfcpdump-debugsource
dtb-aarch64
dtb-amlogic
kernel-64kb-devel
kernel-64kb-devel-debuginfo
kernel-64kb-debugsource
kernel-64kb-debuginfo
dtb-marvell
dtb-mediatek
kernel-zfcpdump
dtb-nvidia
gfs2-kmp-64kb-debuginfo
cluster-md-kmp-64kb
kselftests-kmp-64kb-debuginfo
gfs2-kmp-64kb
dtb-qcom
dtb-freescale
dtb-amazon
dtb-hisilicon
kernel-64kb-optional-debuginfo
kernel-debug-devel-debuginfo
dtb-rockchip
dtb-arm
kernel-64kb
kernel-docs
kernel-source
kernel-source-vanilla
kernel-docs-html
kernel-devel
kernel-macros
kernel-debug-devel
kernel-debug
kernel-default-base
kernel-default-base-rebuild
kernel-source-rt
kernel-devel-rt
kernel-syms-rt
kernel-rt
kernel-rt-debugsource
cluster-md-kmp-rt-debuginfo
ocfs2-kmp-rt
gfs2-kmp-rt-debuginfo
kernel-rt-debuginfo
ocfs2-kmp-rt-debuginfo
dlm-kmp-rt-debuginfo
gfs2-kmp-rt
kernel-rt-devel
cluster-md-kmp-rt
kernel-rt-devel-debuginfo
dlm-kmp-rt
kernel-syms-azure
kernel-azure-devel
kernel-azure-debuginfo
kernel-azure
kernel-azure-debugsource
kernel-azure-devel-debuginfo
kernel-source-azure
kernel-devel-azure
kernel-debuginfo
kernel
bpftool
bpftool-debuginfo
kernel-debugsource
kernel-headers
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
python3-perf-debuginfo
kernel-extra-modules
linux-xilinx (Ubuntu package)
linux-azure (Ubuntu package)
linux-azure-6.8 (Ubuntu package)
linux-azure-fips (Ubuntu package)

How to mitigate CVE-2025-40202

Install update from vendor's repository.

kernel-livepatch-6_4_0-150600_23_87-default - update to 1-150600.13.3.1
kernel-livepatch-6_4_0-150600_23_87-default-debuginfo - update to 1-150600.13.3.1
kernel-livepatch-SLE15-SP6_Update_20-debugsource - update to 1-150600.13.3.1
kernel-livepatch-6_4_0-150700_7_31-rt-debuginfo - update to 1-150700.1.3.2
kernel-livepatch-6_4_0-150700_7_31-rt - update to 1-150700.1.3.2
kernel-livepatch-SLE15-SP7-RT_Update_9-debugsource - update to 1-150700.1.3.2
kernel-livepatch-6_4_0-150700_53_31-default - update to 1-150700.15.3.1
kernel-livepatch-SLE15-SP7_Update_9-debugsource - update to 1-150700.15.3.1
kernel-livepatch-6_4_0-150700_53_31-default-debuginfo - update to 1-150700.15.3.1
ocfs2-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-obs-build-debugsource - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
dlm-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-default-debugsource - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-default-optional - update to 6.4.0-150600.23.87.1
cluster-md-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-syms - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kselftests-kmp-default - update to 6.4.0-150600.23.87.1
kselftests-kmp-default-debuginfo - update to 6.4.0-150600.23.87.1
cluster-md-kmp-default - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
gfs2-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-default-devel - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-obs-qa - update to 6.4.0-150600.23.87.1
kernel-default-optional-debuginfo - update to 6.4.0-150600.23.87.1
kernel-default - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-default-livepatch-devel - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-kvmsmall - update to 6.4.0-150600.23.87.1
kernel-default-extra - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-debug-debugsource - update to 6.4.0-150600.23.87.1
kernel-default-vdso-debuginfo - update to 6.4.0-150600.23.87.1
kernel-default-vdso - update to 6.4.0-150600.23.87.1
kernel-kvmsmall-vdso-debuginfo - update to 6.4.0-150600.23.87.1
kernel-kvmsmall-vdso - update to 6.4.0-150600.23.87.1
kernel-debug-vdso-debuginfo - update to 6.4.0-150600.23.87.1
kernel-debug-vdso - update to 6.4.0-150600.23.87.1
kernel-kvmsmall-devel - update to 6.4.0-150600.23.87.1
kernel-kvmsmall-devel-debuginfo - update to 6.4.0-150600.23.87.1
kernel-kvmsmall-debuginfo - update to 6.4.0-150600.23.87.1
kernel-kvmsmall-debugsource - update to 6.4.0-150600.23.87.1
kernel-default-extra-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
ocfs2-kmp-default - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
reiserfs-kmp-default - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
dlm-kmp-default - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-default-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
reiserfs-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-default-livepatch - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-obs-build - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-default-devel-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-zfcpdump-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
gfs2-kmp-default - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
ocfs2-kmp-64kb-debuginfo - update to 6.4.0-150600.23.87.1
dtb-lg - update to 6.4.0-150600.23.87.1
dtb-renesas - update to 6.4.0-150600.23.87.1
cluster-md-kmp-64kb-debuginfo - update to 6.4.0-150600.23.87.1
dtb-apm - update to 6.4.0-150600.23.87.1
dtb-altera - update to 6.4.0-150600.23.87.1
dtb-amd - update to 6.4.0-150600.23.87.1
reiserfs-kmp-64kb-debuginfo - update to 6.4.0-150600.23.87.1
dtb-sprd - update to 6.4.0-150600.23.87.1
kernel-64kb-extra-debuginfo - update to 6.4.0-150600.23.87.1
dtb-allwinner - update to 6.4.0-150600.23.87.1
dtb-socionext - update to 6.4.0-150600.23.87.1
dlm-kmp-64kb - update to 6.4.0-150600.23.87.1
dtb-cavium - update to 6.4.0-150600.23.87.1
kernel-64kb-extra - update to 6.4.0-150600.23.87.1
kernel-64kb-optional - update to 6.4.0-150600.23.87.1
dtb-apple - update to 6.4.0-150600.23.87.1
ocfs2-kmp-64kb - update to 6.4.0-150600.23.87.1
dtb-exynos - update to 6.4.0-150600.23.87.1
dtb-xilinx - update to 6.4.0-150600.23.87.1
dlm-kmp-64kb-debuginfo - update to 6.4.0-150600.23.87.1
kselftests-kmp-64kb - update to 6.4.0-150600.23.87.1
reiserfs-kmp-64kb - update to 6.4.0-150600.23.87.1
dtb-broadcom - update to 6.4.0-150600.23.87.1
kernel-debug-debuginfo - update to 6.4.0-150600.23.87.1
kernel-zfcpdump-debugsource - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
dtb-aarch64 - update to 6.4.0-150600.23.87.1
dtb-amlogic - update to 6.4.0-150600.23.87.1
kernel-64kb-devel - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-64kb-devel-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-64kb-debugsource - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-64kb-debuginfo - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
dtb-marvell - update to 6.4.0-150600.23.87.1
dtb-mediatek - update to 6.4.0-150600.23.87.1
kernel-zfcpdump - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
dtb-nvidia - update to 6.4.0-150600.23.87.1
gfs2-kmp-64kb-debuginfo - update to 6.4.0-150600.23.87.1
cluster-md-kmp-64kb - update to 6.4.0-150600.23.87.1
kselftests-kmp-64kb-debuginfo - update to 6.4.0-150600.23.87.1
gfs2-kmp-64kb - update to 6.4.0-150600.23.87.1
dtb-qcom - update to 6.4.0-150600.23.87.1
dtb-freescale - update to 6.4.0-150600.23.87.1
dtb-amazon - update to 6.4.0-150600.23.87.1
dtb-hisilicon - update to 6.4.0-150600.23.87.1
kernel-64kb-optional-debuginfo - update to 6.4.0-150600.23.87.1
kernel-debug-devel-debuginfo - update to 6.4.0-150600.23.87.1
dtb-rockchip - update to 6.4.0-150600.23.87.1
dtb-arm - update to 6.4.0-150600.23.87.1
kernel-64kb - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-docs - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-source - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-source-vanilla - update to 6.4.0-150600.23.87.1
kernel-docs-html - update to 6.4.0-150600.23.87.1
kernel-devel - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-macros - addressed in versions 6.4.0-150600.23.87.1, 6.4.0-150700.53.31.1
kernel-debug-devel - update to 6.4.0-150600.23.87.1
kernel-debug - update to 6.4.0-150600.23.87.1
kernel-default-base - addressed in versions 6.4.0-150600.23.87.1.150600.12.40.1, 6.4.0-150700.53.31.1.150700.17.21.1
kernel-default-base-rebuild - update to 6.4.0-150600.23.87.1.150600.12.40.1
kernel-source-rt - update to 6.4.0-150700.7.31.1
kernel-devel-rt - update to 6.4.0-150700.7.31.1
kernel-syms-rt - update to 6.4.0-150700.7.31.1
kernel-rt - update to 6.4.0-150700.7.31.2
kernel-rt-debugsource - update to 6.4.0-150700.7.31.2
cluster-md-kmp-rt-debuginfo - update to 6.4.0-150700.7.31.2
ocfs2-kmp-rt - update to 6.4.0-150700.7.31.2
gfs2-kmp-rt-debuginfo - update to 6.4.0-150700.7.31.2
kernel-rt-debuginfo - update to 6.4.0-150700.7.31.2
ocfs2-kmp-rt-debuginfo - update to 6.4.0-150700.7.31.2
dlm-kmp-rt-debuginfo - update to 6.4.0-150700.7.31.2
gfs2-kmp-rt - update to 6.4.0-150700.7.31.2
kernel-rt-devel - update to 6.4.0-150700.7.31.2
cluster-md-kmp-rt - update to 6.4.0-150700.7.31.2
kernel-rt-devel-debuginfo - update to 6.4.0-150700.7.31.2
dlm-kmp-rt - update to 6.4.0-150700.7.31.2
kernel-syms-azure - update to 6.4.0-150700.20.27.1
kernel-azure-devel - update to 6.4.0-150700.20.27.1
kernel-azure-debuginfo - update to 6.4.0-150700.20.27.1
kernel-azure - update to 6.4.0-150700.20.27.1
kernel-azure-debugsource - update to 6.4.0-150700.20.27.1
kernel-azure-devel-debuginfo - update to 6.4.0-150700.20.27.1
kernel-source-azure - update to 6.4.0-150700.20.27.1
kernel-devel-azure - update to 6.4.0-150700.20.27.1
kernel-debuginfo - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
kernel - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
bpftool - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
bpftool-debuginfo - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
kernel-debugsource - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
kernel-devel - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
kernel-headers - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
kernel-source - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
kernel-tools - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
kernel-tools-debuginfo - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
kernel-tools-devel - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
perf - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
perf-debuginfo - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
python3-perf - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
python3-perf-debuginfo - addressed in versions 6.6.0-121.0.0.111, 6.6.0-121.0.0.123, 6.6.0-121.0.0.124
kernel-extra-modules - update to 6.6.0-121.0.0.124
linux-xilinx (Ubuntu package) - update to 6.8.0-1029.30
linux-azure (Ubuntu package) - update to 6.8.0-1051.57
linux-azure-6.8 (Ubuntu package) - update to 6.8.0-1051.57~22.04.1
linux-azure-fips (Ubuntu package) - update to 6.8.0-1052.58+fips1

External References

Related Security Bulletins