CVE-2025-40022 (GCVE-0-2025-40022)
Vulnerability from cvelistv5
Published
2025-10-24 12:24
Modified
2025-10-24 12:24
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of type u32. However, some assignments to these fields, specifically 'more' and 'merge', assign values greater than 1. These relied on C's implicit conversion to bool, such that zero becomes false and nonzero becomes true. With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken instead, resulting in 0 being assigned in some cases when 1 was intended. Fix this by restoring the bool type.
References
Impacted products
Vendor Product Version
Linux Linux Version: 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce
Version: e4c1ec11132ec466f7362a95f36a506ce4dc08c9
Version: 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8
Version: 7c4491b5644e3a3708f3dbd7591be0a570135b84
Version: 9aee87da5572b3a14075f501752e209801160d3d
Version: 45bcf60fe49b37daab1acee57b27211ad1574042
Version: 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285
 Create a notification for this product.
   Linux Linux Version: 6.1.154   ≤
Version: 6.6.108   ≤
Version: 6.12.49   ≤
Version: 6.16.9   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/crypto/if_alg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3a21698ace915a445bce2d0dcfc84b6d2199baf7",
              "status": "affected",
              "version": "0f28c4adbc4a97437874c9b669fd7958a8c6d6ce",
              "versionType": "git"
            },
            {
              "lessThan": "d382d6daf0184490f366562469a5673f65ee2662",
              "status": "affected",
              "version": "e4c1ec11132ec466f7362a95f36a506ce4dc08c9",
              "versionType": "git"
            },
            {
              "lessThan": "54506c6335690f4ef1b9f154e34f5a604c72c1ed",
              "status": "affected",
              "version": "1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8",
              "versionType": "git"
            },
            {
              "lessThan": "8703940bd30b5ad94408d28d7192db2491cd3592",
              "status": "affected",
              "version": "7c4491b5644e3a3708f3dbd7591be0a570135b84",
              "versionType": "git"
            },
            {
              "lessThan": "316b090c2fee964c307a634fecc7df269664b158",
              "status": "affected",
              "version": "9aee87da5572b3a14075f501752e209801160d3d",
              "versionType": "git"
            },
            {
              "lessThan": "fbe96bd25423e61273d8831e995260b429d850b6",
              "status": "affected",
              "version": "45bcf60fe49b37daab1acee57b27211ad1574042",
              "versionType": "git"
            },
            {
              "lessThan": "d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb",
              "status": "affected",
              "version": "1b34cbbf4f011a121ef7b2d7d6e6920a036d5285",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/crypto/if_alg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.155",
              "status": "affected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.109",
              "status": "affected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.50",
              "status": "affected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16.10",
              "status": "affected",
              "version": "6.16.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.155",
                  "versionStartIncluding": "6.1.154",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "6.6.108",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "6.12.49",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "6.16.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix incorrect boolean values in af_alg_ctx\n\nCommit 1b34cbbf4f01 (\"crypto: af_alg - Disallow concurrent writes in\naf_alg_sendmsg\") changed some fields from bool to 1-bit bitfields of\ntype u32.\n\nHowever, some assignments to these fields, specifically \u0027more\u0027 and\n\u0027merge\u0027, assign values greater than 1.  These relied on C\u0027s implicit\nconversion to bool, such that zero becomes false and nonzero becomes\ntrue.\n\nWith a 1-bit bitfields of type u32 instead, mod 2 of the value is taken\ninstead, resulting in 0 being assigned in some cases when 1 was intended.\n\nFix this by restoring the bool type."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-24T12:24:57.875Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3a21698ace915a445bce2d0dcfc84b6d2199baf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d382d6daf0184490f366562469a5673f65ee2662"
        },
        {
          "url": "https://git.kernel.org/stable/c/54506c6335690f4ef1b9f154e34f5a604c72c1ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/8703940bd30b5ad94408d28d7192db2491cd3592"
        },
        {
          "url": "https://git.kernel.org/stable/c/316b090c2fee964c307a634fecc7df269664b158"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbe96bd25423e61273d8831e995260b429d850b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb"
        }
      ],
      "title": "crypto: af_alg - Fix incorrect boolean values in af_alg_ctx",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40022",
    "datePublished": "2025-10-24T12:24:57.875Z",
    "dateReserved": "2025-04-16T07:20:57.152Z",
    "dateUpdated": "2025-10-24T12:24:57.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40022\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-24T13:15:47.387\",\"lastModified\":\"2025-10-27T13:20:15.637\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: af_alg - Fix incorrect boolean values in af_alg_ctx\\n\\nCommit 1b34cbbf4f01 (\\\"crypto: af_alg - Disallow concurrent writes in\\naf_alg_sendmsg\\\") changed some fields from bool to 1-bit bitfields of\\ntype u32.\\n\\nHowever, some assignments to these fields, specifically \u0027more\u0027 and\\n\u0027merge\u0027, assign values greater than 1.  These relied on C\u0027s implicit\\nconversion to bool, such that zero becomes false and nonzero becomes\\ntrue.\\n\\nWith a 1-bit bitfields of type u32 instead, mod 2 of the value is taken\\ninstead, resulting in 0 being assigned in some cases when 1 was intended.\\n\\nFix this by restoring the bool type.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/316b090c2fee964c307a634fecc7df269664b158\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3a21698ace915a445bce2d0dcfc84b6d2199baf7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/54506c6335690f4ef1b9f154e34f5a604c72c1ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8703940bd30b5ad94408d28d7192db2491cd3592\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d382d6daf0184490f366562469a5673f65ee2662\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fbe96bd25423e61273d8831e995260b429d850b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.