CVE-2025-40292

Root

Cause

Commit 4959aebba8c0 changed the buffer allocation for big packets to depend on MTU instead of MAX_SKB_FRAGS * PAGE_SIZE. However, the check on the received length was not updated accordingly. Since the host can announce a malicious buffer length, this mismatch can lead to the driver processing a length larger than allocated, causing a NULL page pointer dereference in the receive loop.

Exploitation

An attacker controlling the host (e.g., a malicious vhost_net driver) can modify get_rx_bufs to announce an incorrect, oversized length. No authentication is needed from the guest side; the attack is carried out over the virtio transport. The guest must be using big packets (i.e., guest GSO off) for the vulnerable code path to be active.

Impact

Successful exploitation results in a NULL pointer dereference, leading to a kernel crash (denial of service). The vulnerability does not require any special privileges on the guest; it is triggered purely by malicious input from the host.

Mitigation

The fix has been applied in the Linux kernel stable branches via commits [1] and [2]. Administrators should update their kernels to include this patch. No workaround is mentioned; systems should be patched as soon as possible.