CVE-2025-40109

Vulnerability

CVE-2025-40109 is a bug in the Linux kernel's cryptographic random number generator (RNG) subsystem. The root cause is that the set_entropy source callback set_ent` was not guaranteed to be present for all RNG implementations other than the Deterministic Random Bit Generator (DRBG). When a non-DRBG RNG was used, the kernel could attempt to call a NULL function pointer, leading to a NULL pointer dereference [1].

Exploitation

An attacker would need to be able to trigger the use of an RNG that lacks the set_ent callback. This could be achieved by loading or selecting a specific crypto RNG algorithm that does not provide this callback. The attack does not require special privileges beyond the ability to interact with the kernel's crypto subsystem, but the exact prerequisites depend on the system configuration [2].

Impact

A successful exploitation results in a kernel NULL pointer dereference, which typically causes a system crash (denial of service). In some cases, it might be leveraged for privilege escalation or other impacts, but the primary consequence is system instability [3].

Mitigation

The fix has been applied to the Linux kernel stable tree. Users should update to a kernel version that includes the commit that ensures set_ent is always set [4]. No workaround is available other than applying the patch [4].