CVE-2025-40232

Vulnerability

In the Linux kernel's runtime verification (rv) subsystem, the enabled_monitors_seq_ops callbacks were inconsistent: some treated the iterator as struct rv_monitor *, while others treated it as struct list_head *. This type mismatch led to a wrong cast and caused a system crash, as reported by Nathan.

Exploitation

The bug is triggered when reading the enabled_monitors file through the seq_file interface. An attacker with local access can trigger the crash by reading this file, leading to a denial-of-service condition. No authentication is required beyond local user access.

Impact

Successful exploitation results in a system crash (kernel panic), causing denial of service for all users on the affected system.

Mitigation

The vulnerability is fixed in the Linux kernel by commit 103541e6a5854b08a25e4caa61e990af1009a52e, which converts all iterator usage to struct list_head *, making it consistent with available_monitors. Users should apply the stable kernel update containing this fix [1].