Executive brief
A vulnerability in the Linux kernel's networking component could allow a malicious host to crash or compromise a virtualized guest system. The issue occurs when the system processes unusually large network packets, potentially leading to a system crash or unauthorized data access. This affects virtual machines using the virtio-net driver for network connectivity.
Technical details
A vulnerability exists in the virtio-net driver's receive path (receive_big) due to an improper length check for 'big packets' when Guest Generic Segmentation Offload (GSO) is disabled. Following a change that made buffer allocation dependent on the negotiated MTU rather than a fixed maximum, the existing length check became obsolete. A malicious host can announce a buffer length larger than what was actually allocated, triggering a NULL page pointer dereference during the skb fragment processing loop. This can be exploited by a compromised or malicious host/hypervisor to cause a kernel panic or potentially achieve arbitrary code execution within the guest. The fix introduces a corrected length check that validates received data against the actual number of allocated fragments (vi->big_packets_num_skbfrags).
Affected products
- Linux Linux Kernel 6.1 to 6.1.159, 6.6 to 6.6.117, 6.12 to 6.12.58, 6.17 to 6.17.8
Timeline
- 2025-10-30: other: Patch submitted by developer
- 2025-12-07: patched: Fixes merged into stable kernel branches
- 2025-12-08: advisory: CVE-2025-40292 published
References
- https://git.kernel.org/stable/c/0c716703965ffc5ef4311b65cb5d84a703784717
- https://git.kernel.org/stable/c/3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2
- https://git.kernel.org/stable/c/82f9028e83944a9eee5229cbc6fee9be1de8a62d
- https://git.kernel.org/stable/c/82fe78065450d2d07f36a22e2b6b44955cf5ca5b
- https://git.kernel.org/stable/c/946dec89c41726b94d31147ec528b96af0be1b5a