What is CVE-2025-40302?

CVE-2025-40302 is a high-severity vulnerability in Linux. CVSS score: 7.8/10. Published 2025-12-08.

How severe is CVE-2025-40302?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Linux

CVE-2025-40302

In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid remove_bufs when legacy fileio is active vb2_ioctl_remove_bufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl when fileio is active to protect internal queue state between subsequent read/write calls.

EPSS: 0.002 (6.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Linux — versions a3293a85381ec9680aa2929547fbc76c5d87a1b2, 6.10, 0

References

416baaa9-dc9f-4396-8d5f-8c081fb06d67
416baaa9-dc9f-4396-8d5f-8c081fb06d67
416baaa9-dc9f-4396-8d5f-8c081fb06d67

Frequently asked questions

What is CVE-2025-40302?: CVE-2025-40302 is a high-severity vulnerability in Linux. CVSS score: 7.8/10. Published 2025-12-08.
How severe is CVE-2025-40302?: High severity. CVSS v3 base score is 7.8 out of 10.