CVE-2025-40290

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16.12+deb14-cloud-amd64 #1

Description The Linux kernel contained a flaw in the xsk (XDP socket) subsystem related to descriptor number handling on completion queues. A commit (30f241fcf52a) initially introduced an issue where the descriptor number was stored in the skb control block, which is not suitable for long-term storage as other subsystems might utilize it. This led to a potential NULL pointer dereference and a kernel panic. The issue was addressed by utilizing the skb destructor arg pointer along with pointer tagging to ensure data integrity.

Recommendations Update to Linux kernel version 6.16.12+deb14-cloud-amd64 #1 or a later version to resolve this issue.