Vulnerability in Linux

CVE-2025-40266

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel.

EPSS: 0.002 (6.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

  • Linux — versions 6211753fdfd05af9e08f54c8d0ba3ee516034878, 3.11, 0

References

Frequently asked questions

What is CVE-2025-40266?
CVE-2025-40266 is a high-severity vulnerability in Linux. CVSS score: 8.2/10. Published 2025-12-04.
How severe is CVE-2025-40266?
High severity. CVSS v3 base score is 8.2 out of 10.