01 Record

CVE-2025-40280

tipc: Fix use-after-free in tipc_mon_reinit_self().

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

tipc: Fix use-after-free in tipc_mon_reinit_self().

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.14% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 3.8% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Deferred. NVD last modified this record on 2026-07-30.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-12-06 21:51Z10 MO AGO

Last updated

2026-08-05 12:09Z2 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-825Expired Pointer DereferenceBase

Data version

5.2

Document digest

c41821002305fe033599e2beb983841cf1633fe5c7ad4d97944e2c1c53eb9da4

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux28845c28f842e9e55e75b2c116bff714bb039055 to < 5f541300b02ef8b2af34f6f7d41ce617f3571e88, 46cb01eeeb86fca6afe24dda1167b0cb95424e29 to < b2e77c789c234e7fe49057d2ced8f32e2d2c7901, 46cb01eeeb86fca6afe24dda1167b0cb95424e29 to < 51b8f0ab888f8aa5dfac954918864eeda8c12c19, 46cb01eeeb86fca6afe24dda1167b0cb95424e29 to < 499b5fa78d525c4450ebb76db83207db71efea77, 46cb01eeeb86fca6afe24dda1167b0cb95424e29 to < c92dbf85627b5c29e52d9c120a24e785801716df, 46cb01eeeb86fca6afe24dda1167b0cb95424e29 to < f0104977fed25ebe001fd63dab2b6b7fefad3373, 46cb01eeeb86fca6afe24dda1167b0cb95424e29 to < fdf7c4c9af4f246323ce854e84b6aec198d49f7e, 46cb01eeeb86fca6afe24dda1167b0cb95424e29 to < 0725e6afb55128be21a2ca36e9674f573ccec173, 295c9b554f6dfcd2d368fae6e6fa22ee5b79c123, 5.4.15 to < 5.4.302, 4.19.99 to < 4.20, 5.5—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/5f541300b02ef8b2af34f6f7d41ce617f3571e88
git.kernel.orghttps://git.kernel.org/stable/c/b2e77c789c234e7fe49057d2ced8f32e2d2c7901
git.kernel.orghttps://git.kernel.org/stable/c/51b8f0ab888f8aa5dfac954918864eeda8c12c19
git.kernel.orghttps://git.kernel.org/stable/c/499b5fa78d525c4450ebb76db83207db71efea77
git.kernel.orghttps://git.kernel.org/stable/c/c92dbf85627b5c29e52d9c120a24e785801716df
git.kernel.orghttps://git.kernel.org/stable/c/f0104977fed25ebe001fd63dab2b6b7fefad3373
git.kernel.orghttps://git.kernel.org/stable/c/fdf7c4c9af4f246323ce854e84b6aec198d49f7e
git.kernel.orghttps://git.kernel.org/stable/c/0725e6afb55128be21a2ca36e9674f573ccec173
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-253495.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.159-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.63-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.17.9-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.