CVE-2025-40281

Ecosystem	Package	Version

Vulnerabilities

CVE-2025-40281

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto syzbot reported a possible shift-out-of-bounds [1] Blamed commit added rto_alpha_max and rto_beta_max set to 1000. It is unclear if some sctp users are setting very large rto_alpha and/or rto_beta. In order to prevent user regression, perform the test at run time. Also add READ_ONCE() annotations as sysctl values can change under us. [1] UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41 shift exponent 64 is too large for 32-bit type 'unsigned int' CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:233 [inline] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494 sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509 sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502 sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338 sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]

Published Dec 9, 2025

https://lore.kernel.org/linux-cve-announce/2025120718-CVE-2025-40281-557d@gregkh/

CVSS ScoreMedium

4.8


rpm	kernel	4.18.0-147.0.2.el8_1
rpm	kernel	4.18.0-147.0.3.el8_1
rpm	kernel	4.18.0-147.3.1.el8_1
rpm	kernel	4.18.0-147.5.1.el8_1
rpm	kernel	4.18.0-147.8.1.el8_1
rpm	kernel	4.18.0-147.el8
rpm	kernel	4.18.0-193.1.2.el8_2
rpm	kernel	4.18.0-193.13.2.el8_2
rpm	kernel	4.18.0-193.14.3.el8_2
rpm	kernel	4.18.0-193.19.1.el8_2
rpm	kernel	4.18.0-193.28.1.el8_2
rpm	kernel	4.18.0-193.6.3.el8_2
rpm	kernel	4.18.0-193.el8
rpm	kernel	4.18.0-240.1.1.el8_3
rpm	kernel	4.18.0-240.10.1.el8_3
rpm	kernel	4.18.0-240.15.1.el8_3
rpm	kernel	4.18.0-240.22.1.el8_3
rpm	kernel	4.18.0-240.8.1.el8_3
rpm	kernel	4.18.0-240.el8
rpm	kernel	4.18.0-293.el8
rpm	kernel	4.18.0-305.10.2.el8_4
rpm	kernel	4.18.0-305.12.1.el8_4
rpm	kernel	4.18.0-305.17.1.el8_4
rpm	kernel	4.18.0-305.19.1.el8_4
rpm	kernel	4.18.0-305.25.1.el8_4
rpm	kernel	4.18.0-305.3.1.el8_4
rpm	kernel	4.18.0-305.7.1.el8_4
rpm	kernel	4.18.0-305.el8
rpm	kernel	4.18.0-348.12.2.el8_5
rpm	kernel	4.18.0-348.2.1.el8_5
rpm	kernel	4.18.0-348.20.1.el8_5
rpm	kernel	4.18.0-348.23.1.el8_5
rpm	kernel	4.18.0-348.7.1.el8_5
rpm	kernel	4.18.0-348.el8
rpm	kernel	4.18.0-372.13.1.0.1.el8_6
rpm	kernel	4.18.0-372.13.1.0.2.el8_6
rpm	kernel	4.18.0-372.16.1.0.1.el8_6
rpm	kernel	4.18.0-372.16.1.0.2.el8_6
rpm	kernel	4.18.0-372.19.1.0.1.el8_6
rpm	kernel	4.18.0-372.19.1.0.2.el8_6
rpm	kernel	4.18.0-372.26.1.0.1.el8_6
rpm	kernel	4.18.0-372.26.1.0.2.el8_6
rpm	kernel	4.18.0-372.32.1.0.1.el8_6
rpm	kernel	4.18.0-372.32.1.0.2.el8_6
rpm	kernel	4.18.0-372.9.1.0.2.el8
rpm	kernel	4.18.0-372.9.1.el8
rpm	kernel	4.18.0-425.10.1.0.1.el8_7
rpm	kernel	4.18.0-425.10.1.el8_7
rpm	kernel	4.18.0-425.13.1.0.1.el8_7
rpm	kernel	4.18.0-425.13.1.el8_7

Ecosystem	Package	Version

CVE-2025-40281 | Components Impacted | Sonatype Guide | Sonatype Guide

Find vulnerabilities. Fix fast with AI.

CVE-2025-40281