SECUFOCUSNOW
Home›CVE index›CVE-2025-40292
Review reviewHigh

CVE-2025-40292

Linux

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix received length check in big packets Since commit 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets"), when guest gso is off, the allocated size for big packets is not MAX_SKB_FRAGS * PAGE_SIZE anymore but depends on negotiated MTU. The number of allocated frags for big packets is stored in vi->big_packets_num_skbfrags. Because the host announced buffer length can be malicious (e.g. the host vhost_net driver's get_rx_bufs is modified to announce incorrect length), we need a check in vi...

CVSS
8.4
EPSS
0.17%
6.21% percentile
CISA KEV
Not listed
Published
2025.12.08
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.17%
Technical severityCVSS 8.4

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix received length check in big packets Since commit 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets"), when guest gso is off, the allocated size for big packets is not MAX_SKB_FRAGS * PAGE_SIZE anymore but depends on negotiated MTU. The number of allocated frags for big packets is stored in vi->big_packets_num_skbfrags. Because the host announced buffer length can be malicious (e.g. the host vhost_net driver's get_rx_bufs is modified to announce incorrect length), we need a check in vi...

Affected product and versions

Product
Linux
Affected versions
>= 4959aebba8c06992abafa09d1e80965e0825af54 < 82f9028e83944a9eee5229cbc6fee9be1de8a62d, >= 4959aebba8c06992abafa09d1e80965e0825af54 < 946dec89c41726b94d31147ec528b96af0be1b5a, >= 4959aebba8c06992abafa09d1e80965e0825af54 < 82fe78065450d2d07f36a22e2b6b44955cf5ca5b, >= 4959aebba8c06992abafa09d1e80965e0825af54 < 3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2, >= 4959aebba8c06992abafa09d1e80965e0825af54 < 0c716703965ffc5ef4311b65cb5d84a703784717, >= 6.1
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available