Linux Kernel up to 5.4.301/6.6.117/6.12.59/6.17.9 nsh_key_put_from_nlattr null pointer dereference

CVSS Meta Temp Score
CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.
Current Exploit Price (≈)
Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.
CTI Interest Score
Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
4.6$0-$5k0.00

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.4.301/6.6.117/6.12.59/6.17.9. It has been declared as critical. Affected by this vulnerability is the function nsh_key_put_from_nlattr. Executing a manipulation can lead to null pointer dereference. This vulnerability is tracked as CVE-2025-40254. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.4.301/6.6.117/6.12.59/6.17.9. It has been declared as critical. This vulnerability affects the function nsh_key_put_from_nlattr. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: remove never-working support for setting nsh fields The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function that is the same function that validates NSH keys for the flow match and the push_nsh() action. However, the set(nsh(...)) has a very different memory layout. Nested attributes in there are doubled in size in case of the masked set(). That makes proper validation impossible. There is also confusion in the code between the 'masked' flag, that says that the nested attributes are doubled in size containing both the value and the mask, and the 'is_mask' that says that the value we're parsing is the mask. This is causing kernel crash on trying to write into mask part of the match with SW_FLOW_KEY_PUT() during validation, while validate_nsh() doesn't allocate any memory for it: BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary) RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch] Call Trace: <TASK> validate_nsh+0x60/0x90 [openvswitch] validate_set.constprop.0+0x270/0x3c0 [openvswitch] __ovs_nla_copy_actions+0x477/0x860 [openvswitch] ovs_nla_copy_actions+0x8d/0x100 [openvswitch] ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch] genl_family_rcv_msg_doit+0xdb/0x130 genl_family_rcv_msg+0x14b/0x220 genl_rcv_msg+0x47/0xa0 netlink_rcv_skb+0x53/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x280/0x3b0 netlink_sendmsg+0x1f7/0x430 ____sys_sendmsg+0x36b/0x3a0 ___sys_sendmsg+0x87/0xd0 __sys_sendmsg+0x6d/0xd0 do_syscall_64+0x7b/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The third issue with this process is that while trying to convert the non-masked set into masked one, validate_set() copies and doubles the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested attributes. It should be copying each nested attribute and doubling them in size independently. And the process must be properly reversed during the conversion back from masked to a non-masked variant during the flow dump. In the end, the only two outcomes of trying to use this action are either validation failure or a kernel crash. And if somehow someone manages to install a flow with such an action, it will most definitely not do what it is supposed to, since all the keys and the masks are mixed up. Fixing all the issues is a complex task as it requires re-writing most of the validation code. Given that and the fact that this functionality never worked since introduction, let's just remove it altogether. It's better to re-introduce it later with a proper implementation instead of trying to fix it in stable releases.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2025-40254 since 04/16/2025. The exploitation appears to be difficult. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 277528 (Linux Distros Unpatched Vulnerability : CVE-2025-40254), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.4.302, 6.6.118, 6.12.60 or 6.17.10 eliminates this vulnerability. Applying the patch 3415faa1fcb4150f29a72c5ecf959339d797feb7/0b903f33c31c82b1c3591279fd8a23893802b987/9c61d8fe1350b7322f4953318165d6719c3b1475/4689ba45296dbb3a47e70a1bc2ed0328263e48f3/dfe28c4167a9259fc0c372d9f9473e1ac95cff67 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (277528), EUVD (EUVD-2025-201203) and CERT Bund (WID-SEC-2025-2747). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

  • Debian Linux
  • Google Cloud Platform
  • Amazon Linux 2
  • Red Hat Enterprise Linux
  • Ubuntu Linux
  • SUSE Linux
  • Oracle Linux
  • SUSE openSUSE
  • Open Source Linux Kernel
  • RESF Rocky Linux
  • Microsoft Azure Linux

Productinfo

Type

Vendor

Name

Version

License

Website

CPE 2.3info

CPE 2.2info

CVSSv4info

VulDB Vector: 🔒
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 4.8
VulDB Meta Temp Score: 4.6

VulDB Base Score: 4.8
VulDB Temp Score: 4.6
VulDB Vector: 🔒
VulDB Reliability: 🔍

CVSSv2info

AVACAuCIA
💳💳💳💳💳💳
💳💳💳💳💳💳
💳💳💳💳💳💳
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍

Exploitinginfo

Class: Null pointer dereference
CWE: CWE-476 / CWE-404
CAPEC: 🔒
ATT&CK: 🔒

Physical: No
Local: No
Remote: Partially

Availability: 🔒
Status: Not defined

EPSS Score: 🔒
EPSS Percentile: 🔒

Price Prediction: 🔍
Current Price Estimation: 🔒

0-DayUnlockUnlockUnlockUnlock
TodayUnlockUnlockUnlockUnlock

Nessus ID: 277528
Nessus Name: Linux Distros Unpatched Vulnerability : CVE-2025-40254

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: Kernel 5.4.302/6.6.118/6.12.60/6.17.10
Patch: 3415faa1fcb4150f29a72c5ecf959339d797feb7/0b903f33c31c82b1c3591279fd8a23893802b987/9c61d8fe1350b7322f4953318165d6719c3b1475/4689ba45296dbb3a47e70a1bc2ed0328263e48f3/dfe28c4167a9259fc0c372d9f9473e1ac95cff67

Timelineinfo

04/16/2025 CVE reserved
12/04/2025 +232 days Advisory disclosed
12/04/2025 +0 days VulDB entry created
02/24/2026 +82 days VulDB entry last update

Sourcesinfo

Vendor: kernel.org

Advisory: git.kernel.org
Status: Confirmed

CVE: CVE-2025-40254 (🔒)
GCVE (CVE): GCVE-0-2025-40254
GCVE (VulDB): GCVE-100-334312
EUVD: 🔒
CERT Bund: WID-SEC-2025-2747 - Linux Kernel: Mehrere Schwachstellen erm&ouml;glichen Denial of Service

Entryinfo

Created: 12/04/2025 17:37
Updated: 02/24/2026 08:02
Changes: 12/04/2025 17:37 (58), 12/06/2025 07:58 (1), 12/06/2025 12:38 (2), 12/07/2025 01:12 (1), 01/05/2026 04:18 (7), 02/24/2026 08:02 (1)
Complete: 🔍
Cache ID: 216::103

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!