CVE-2025-40331

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a time-of-check to time-of-use (TOCTOU) issue that can lead to an out-of-bounds write. This occurs in the sctp diag dump() function, which calls sctp for each endpoint() and sctp ep dump(). The issue arises when the address list grows between the time the buffer is allocated and the time data is written to it, without the sock lock being held.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.