Linux Kernel up to 6.17.3 _set_reqsize cra_reqsize initialization

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.17.3. The affected element is the function _set_reqsize. The manipulation of the argument cra_reqsize results in initialization. This vulnerability is known as CVE-2025-40182. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.17.3. It has been classified as critical. Affected is the function _set_reqsize. The manipulation of the argument cra_reqsize with an unknown input leads to a initialization vulnerability. CWE is classifying the issue as CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: crypto: skcipher - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fields. It looks like this was introduced specifically for ahash and acomp from the commit description as subsequent commits add necessary changes in these alg frameworks. However, this is being recommended for use in all crypto algs [1] instead of setting reqsize using crypto_*_set_reqsize(). Using cra_reqsize in skcipher algorithms, hence, causes memory corruptions and crashes as the underlying functions in the algorithm framework have not been updated to set the reqsize properly from cra_reqsize. [2] Add proper set_reqsize calls in the skcipher init function to properly initialize reqsize for these algorithms in the framework. [1]: https://lore.kernel.org/linux-crypto/[email protected]/ [2]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2025-40182 since 04/16/2025. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 02/07/2026).

The vulnerability scanner Nessus provides a plugin with the ID 275344 (Linux Distros Unpatched Vulnerability : CVE-2025-40182), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.17.4 or 6.18-rc1 eliminates this vulnerability. Applying the patch f041339d6b9a5a46437f0c48fc7279c92af7a513/229c586b5e86979badb7cb0d38717b88a9e95ddd is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (275344) and CERT Bund (WID-SEC-2025-2595). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Linux Kernel
• RESF Rocky Linux

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.17.0
• 6.17.1
• 6.17.2
• 6.17.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion