Review reviewHigh

CVE-2025-40063

Linux

In the Linux kernel, the following vulnerability has been resolved: crypto: comp - Use same definition of context alloc and free ops In commit 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp"), the crypto_acomp_streams struct was made to rely on having the alloc_ctx and free_ctx operations defined in the same order as the scomp_alg struct. But in that same commit, the alloc_ctx and free_ctx members of scomp_alg may be randomized by structure layout randomization, since they are contained in a pure ops structure (containing only function pointers). If the pointers...

CVSS: 7
EPSS: 0.12%
CISA KEV: Not listed
Published: 2025.10.28

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.12%

Technical severityCVSS 7

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= 42d9f6c774790d290c175e8775ce9f1366438098 < 779d3b6f2d32c5f1da6163e959abe1e1ffe2945b, >= 42d9f6c774790d290c175e8775ce9f1366438098 < f75f66683ded09f7135aef2e763c245a07c8271a, >= 6.16
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available