CVE-2025-40331

Linux Kernel - Out-of-Bounds Write via SCTP Diag Dump Address List

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: Prevent TOCTOU out-of-bounds write For the following path not holding the sock lock, sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump() make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use).

References (8)

Core 8

Scores

EPSS 0.0008
EPSS Percentile 22.8%

Details

Status published
Products (25)
linux/Kernel 4.7.0 - 5.4.302linux
linux/Kernel 5.11.0 - 5.15.197linux
linux/Kernel 5.16.0 - 6.1.159linux
linux/Kernel 5.5.0 - 5.10.247linux
linux/Kernel 6.13.0 - 6.17.8linux
linux/Kernel 6.2.0 - 6.6.117linux
linux/Kernel 6.7.0 - 6.12.58linux
Linux/Linux < 4.7
Linux/Linux 4.7
Linux/Linux 5.10.247 - 5.10.*
... and 15 more
Published Dec 09, 2025
Tracked Since Feb 18, 2026