CVE-2025-40008

Vulnerability

Description

CVE-2025-40008 is a bug in the Linux kernel's Kernel Memory Sanitizer (KMSAN) that causes an out-of-bounds access to shadow memory. The issue occurs in the function kmsan_internal_set_shadow_origin(). When memset() is called on a buffer that is not 4-byte aligned and extends to the end of a guard page (i.e., the next page is unmapped), the function incorrectly calculates the shadow memory address to read. Specifically, it rounds the address and size to access all origins associated with the buffer, but then uses the original unrounded shadow address when checking the corresponding shadow bytes. This leads to reading from shadow memory beyond the end of the buffer's shadow memory, causing a page fault and kernel crash [1][2].

Exploitation

An attacker would need to trigger a memset() call on a non-4-byte-aligned buffer that ends exactly at a guard page boundary. This can be achieved through specific kernel operations, such as running the sha224_kunit test as shown in the crash trace. The vulnerability is triggered during normal kernel operations when KMSAN is enabled, and no special privileges are required beyond being able to execute code that performs such a memset() call. The attack surface is limited to systems with KMSAN enabled, which is typically used for debugging and testing purposes [1][2].

Impact

Successful exploitation results in a kernel crash (Oops) due to an unhandled page fault, leading to a denial of service (DoS). The crash is reproducible and can be triggered by legitimate kernel operations, making it a reliability issue for systems using KMSAN. There is no indication of memory corruption or privilege escalation beyond the crash itself [1][2].

Mitigation

The fix is to correctly align the shadow address before accessing the four shadow bytes corresponding to each origin. The patch has been applied to the Linux kernel stable tree, as seen in commits [1] and [2]. Users should update to a kernel version containing the fix. No workaround is available other than disabling KMSAN, which is typically only used for debugging [1][2].