{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-40008",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-40008",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-10-20T15:26:54.568Z",
    "updatedAt": "2026-05-23T16:01:15.772Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "kmsan: fix out-of-bounds access to shadow memory",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nkmsan: fix out-of-bounds access to shadow memory\n\nRunning sha224_kunit on a KMSAN-enabled kernel results in a crash in\nkmsan_internal_set_shadow_origin():\n\n    BUG: unable to handle page fault for address: ffffbc3840291000\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    PGD 1810067 P4D 1810067 PUD 192d067 PMD 3c17067 PTE 0\n    Oops: 0000 [#1] SMP NOPTI\n    CPU: 0 UID: 0 PID: 81 Comm: kunit_try_catch Tainted: G                 N  6.17.0-rc3 #10 PREEMPT(voluntary)\n    Tainted: [N]=TEST\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n    RIP: 0010:kmsan_internal_set_shadow_origin+0x91/0x100\n    [...]\n    Call Trace:\n    <TASK>\n    __msan_memset+0xee/0x1a0\n    sha224_final+0x9e/0x350\n    test_hash_buffer_overruns+0x46f/0x5f0\n    ? kmsan_get_shadow_origin_ptr+0x46/0xa0\n    ? __pfx_test_hash_buffer_overruns+0x10/0x10\n    kunit_try_run_case+0x198/0xa00\n\nThis occurs when memset() is called on a buffer that is not 4-byte aligned\nand extends to the end of a guard page, i.e.  the next page is unmapped.\n\nThe bug is that the loop at the end of kmsan_internal_set_shadow_origin()\naccesses the wrong shadow memory bytes when the address is not 4-byte\naligned.  Since each 4 bytes are associated with an origin, it rounds the\naddress and size so that it can access all the origins that contain the\nbuffer.  However, when it checks the corresponding shadow bytes for a\nparticular origin, it incorrectly uses the original unrounded shadow\naddress.  This results in reads from shadow memory beyond the end of the\nbuffer's shadow memory, which crashes when that memory is not mapped.\n\nTo fix this, correctly align the shadow address before accessing the 4\nshadow bytes corresponding to each origin.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9ff078f5bad8990091f1639347de5e02636e9536",
              "status": "affected",
              "versionType": "git",
              "lessThan": "e6684ed39edc35401a3341f85b1ab50a6f89a45d"
            },
            {
              "version": "19e85d939001946671643f4c16e1de8c633a6ce0",
              "status": "affected",
              "versionType": "git",
              "lessThan": "df1fa034c0fc229a63d01ffb20bb919b839cb576"
            },
            {
              "version": "2ef3cec44c60ae171b287db7fc2aa341586d65ba",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f84e48707051812289b6c2684d4df2daa9d3bfbc"
            },
            {
              "version": "2ef3cec44c60ae171b287db7fc2aa341586d65ba",
              "status": "affected",
              "versionType": "git",
              "lessThan": "5855792c6bb9a825607845db3feaddaff0414ec3"
            },
            {
              "version": "2ef3cec44c60ae171b287db7fc2aa341586d65ba",
              "status": "affected",
              "versionType": "git",
              "lessThan": "85e1ff61060a765d91ee62dc5606d4d547d9d105"
            },
            {
              "version": "abeede7011da6c88e83ed260b909c140b8c9c250",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "6.1.94",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.1.155"
            },
            {
              "version": "6.6.34",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.6.109"
            },
            {
              "version": "6.9.5",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.10"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.10",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.10"
            },
            {
              "version": "6.1.155",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.109",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.50",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.16.10",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.16.*"
            },
            {
              "version": "6.17",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}