CVE-2025-40262

Vulnerability

Details

CVE-2025-40262 is a memory corruption vulnerability in the Linux kernel's imx_sc_key input driver, introduced by a trivial but dangerous coding mistake. The driver's remove function incorrectly passes the address of the local priv pointer (&priv) to a cleanup call, rather than the pointer itself. This means the kernel writes to a location on the call stack instead of the actual driver-private data structure, leading to stack memory corruption when imx_sc_key_action() is invoked.

Exploitation

Context

The vulnerability is triggered during normal driver unload (module removal or device unbind). No special privileges or authentication are required beyond having the imx_sc_key driver loaded and being able to trigger its removal. Because the corruption occurs on the kernel stack, it can corrupt return addresses and other critical stack data, potentially allowing an attacker to control execution flow. The bug is a classic example of a use-after-free or stack buffer overflow in disguise: the freed priv pointer is never used, but the address-of operator causes the kernel to write to an unintended stack location.

Impact

Successful exploitation could lead to a denial of service (kernel crash) or, in more sophisticated scenarios, arbitrary code execution with kernel privileges. Since the corruption happens during driver removal, a local attacker who can force repeated load/unload cycles might escalate privileges. The vulnerability was introduced when the code was written and affects all kernel versions containing the faulty patch. It has been assigned a CVSS score based on the ability to corrupt kernel memory; however, practical exploitation requires precise control over the stack layout.

Mitigation

Patches are available in the Linux kernel stable tree (commit references [1], [2], [3]). Users should update to a kernel version that includes the fix, which simply removes the ampersand to pass the correct pointer. No workarounds are known other than not loading or unloading the affected driver. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.