Review reviewHigh

CVE-2025-40364

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can import provided buffers, commit the ring state by giving up on that before, it'll be reimported later if needed.

CVSS: 7.8
EPSS: -
CISA KEV: Not listed
Published: 2025.04.18

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 233b210a678bddf8b49b02a070074a52b87e6d43, >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < a1b17713b32c75a90132ea2f92b1257f3bbc20f3, >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < b86f1d51731e621e83305dc9564ae14c9ef752bf, >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3, >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 35ae7910c349fb3c60439992e2e0e79061e95382, >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < f0ef94553868d07c1b14d7743a7e2553e5a831a3, >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < d63b0e8a628e62ca85a0f7915230186bb92f8bb4, >= 5.19, >= 5.19 < 6.1.129, >= 6.2 < 6.6.78, >= 6.7 < 6.12.14, >= 6.13 < 6.13.3
Fixed versions: 6.1.129, 6.6.78, 6.12.14, 6.13.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available