GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40012 (GCVE-0-2025-40012)

Vulnerability from cvelistv5 – Published: 2025-10-20 15:26 – Updated: 2026-08-05 12:07
VLAI
Title
net/smc: fix warning in smc_rx_splice() when calling get_page()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix warning in smc_rx_splice() when calling get_page() smc_lo_register_dmb() allocates DMB buffers with kzalloc(), which are later passed to get_page() in smc_rx_splice(). Since kmalloc memory is not page-backed, this triggers WARN_ON_ONCE() in get_page() and prevents holding a refcount on the buffer. This can lead to use-after-free if the memory is released before splice_to_pipe() completes. Use folio_alloc() instead, ensuring DMBs are page-backed and safe for get_page(). WARNING: CPU: 18 PID: 12152 at ./include/linux/mm.h:1330 smc_rx_splice+0xaf8/0xe20 [smc] CPU: 18 UID: 0 PID: 12152 Comm: smcapp Kdump: loaded Not tainted 6.17.0-rc3-11705-g9cf4672ecfee #10 NONE Hardware name: IBM 3931 A01 704 (z/VM 7.4.0) Krnl PSW : 0704e00180000000 000793161032696c (smc_rx_splice+0xafc/0xe20 [smc]) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000000000000000 001cee80007d3001 00077400000000f8 0000000000000005 0000000000000001 001cee80007d3006 0007740000001000 001c000000000000 000000009b0c99e0 0000000000001000 001c0000000000f8 001c000000000000 000003ffcc6f7c88 0007740003e98000 0007931600000005 000792969b2ff7b8 Krnl Code: 0007931610326960: af000000 mc 0,0 0007931610326964: a7f4ff43 brc 15,00079316103267ea #0007931610326968: af000000 mc 0,0 >000793161032696c: a7f4ff3f brc 15,00079316103267ea 0007931610326970: e320f1000004 lg %r2,256(%r15) 0007931610326976: c0e53fd1b5f5 brasl %r14,000793168fd5d560 000793161032697c: a7f4fbb5 brc 15,00079316103260e6 0007931610326980: b904002b lgr %r2,%r11 Call Trace: smc_rx_splice+0xafc/0xe20 [smc] smc_rx_splice+0x756/0xe20 [smc]) smc_rx_recvmsg+0xa74/0xe00 [smc] smc_splice_read+0x1ce/0x3b0 [smc] sock_splice_read+0xa2/0xf0 do_splice_read+0x198/0x240 splice_file_to_pipe+0x7e/0x110 do_splice+0x59e/0xde0 __do_splice+0x11a/0x2d0 __s390x_sys_splice+0x140/0x1f0 __do_syscall+0x122/0x280 system_call+0x6e/0x90 Last Breaking-Event-Address: smc_rx_splice+0x960/0xe20 [smc] ---[ end trace 0000000000000000 ]---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f7a22071dbf316c982fb44308874bd7ad9ac2091 , < 14fc4fdae42e34d7ee871b292ac2ecc61c2c5de7 (git)
Affected: f7a22071dbf316c982fb44308874bd7ad9ac2091 , < d5411685dc2f6ac7bdf01a0a204d56cae38c6cf6 (git)
Affected: f7a22071dbf316c982fb44308874bd7ad9ac2091 , < a35c04de2565db191726b5741e6b66a35002c652 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.50 , ≤ 6.12.* (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_loopback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "14fc4fdae42e34d7ee871b292ac2ecc61c2c5de7",
              "status": "affected",
              "version": "f7a22071dbf316c982fb44308874bd7ad9ac2091",
              "versionType": "git"
            },
            {
              "lessThan": "d5411685dc2f6ac7bdf01a0a204d56cae38c6cf6",
              "status": "affected",
              "version": "f7a22071dbf316c982fb44308874bd7ad9ac2091",
              "versionType": "git"
            },
            {
              "lessThan": "a35c04de2565db191726b5741e6b66a35002c652",
              "status": "affected",
              "version": "f7a22071dbf316c982fb44308874bd7ad9ac2091",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_loopback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix warning in smc_rx_splice() when calling get_page()\n\nsmc_lo_register_dmb() allocates DMB buffers with kzalloc(), which are\nlater passed to get_page() in smc_rx_splice(). Since kmalloc memory is\nnot page-backed, this triggers WARN_ON_ONCE() in get_page() and prevents\nholding a refcount on the buffer. This can lead to use-after-free if\nthe memory is released before splice_to_pipe() completes.\n\nUse folio_alloc() instead, ensuring DMBs are page-backed and safe for\nget_page().\n\nWARNING: CPU: 18 PID: 12152 at ./include/linux/mm.h:1330 smc_rx_splice+0xaf8/0xe20 [smc]\nCPU: 18 UID: 0 PID: 12152 Comm: smcapp Kdump: loaded Not tainted 6.17.0-rc3-11705-g9cf4672ecfee #10 NONE\nHardware name: IBM 3931 A01 704 (z/VM 7.4.0)\nKrnl PSW : 0704e00180000000 000793161032696c (smc_rx_splice+0xafc/0xe20 [smc])\n           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3\nKrnl GPRS: 0000000000000000 001cee80007d3001 00077400000000f8 0000000000000005\n           0000000000000001 001cee80007d3006 0007740000001000 001c000000000000\n           000000009b0c99e0 0000000000001000 001c0000000000f8 001c000000000000\n           000003ffcc6f7c88 0007740003e98000 0007931600000005 000792969b2ff7b8\nKrnl Code: 0007931610326960: af000000\t\tmc\t0,0\n           0007931610326964: a7f4ff43\t\tbrc\t15,00079316103267ea\n          #0007931610326968: af000000\t\tmc\t0,0\n          \u003e000793161032696c: a7f4ff3f\t\tbrc\t15,00079316103267ea\n           0007931610326970: e320f1000004\tlg\t%r2,256(%r15)\n           0007931610326976: c0e53fd1b5f5\tbrasl\t%r14,000793168fd5d560\n           000793161032697c: a7f4fbb5\t\tbrc\t15,00079316103260e6\n           0007931610326980: b904002b\t\tlgr\t%r2,%r11\nCall Trace:\n smc_rx_splice+0xafc/0xe20 [smc]\n smc_rx_splice+0x756/0xe20 [smc])\n smc_rx_recvmsg+0xa74/0xe00 [smc]\n smc_splice_read+0x1ce/0x3b0 [smc]\n sock_splice_read+0xa2/0xf0\n do_splice_read+0x198/0x240\n splice_file_to_pipe+0x7e/0x110\n do_splice+0x59e/0xde0\n __do_splice+0x11a/0x2d0\n __s390x_sys_splice+0x140/0x1f0\n __do_syscall+0x122/0x280\n system_call+0x6e/0x90\nLast Breaking-Event-Address:\nsmc_rx_splice+0x960/0xe20 [smc]\n---[ end trace 0000000000000000 ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached via the splice() syscall on a local AF_SMC socket, and loopback-ism explicitly rejects any peer whose GID differs from the local GID (smc_lo_query_rgid), so both endpoints must be on the same host. No remote or adjacent packet can reach smc_lo_register_dmb().\nAC:L - The attacker deterministically controls the entire sequence \u2014 establish a loopback AF_SMC connection, send data, splice it into a pipe, close the sockets to free the DMB, then read the pipe; no race window or attacker-uninfluenceable state is required. Heap reuse of the freed 16 KB\u20131 MB region is groomable from userspace.\nPR:L - There is no capability check anywhere on the path: socket(AF_SMC) (which even autoloads the module without CAP_NET_ADMIN), connect/listen on 127.0.0.1, and splice() are all available to any unprivileged local user. No root or namespace privilege is needed.\nUI:N - A single unprivileged process can act as both SMC client and server on loopback and drive the whole sequence itself. No victim action or interaction is involved.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Because get_page() takes no reference, the DMB can be kvfree()\u0027d while the pipe still points at it; subsequently reading or re-splicing the pipe copies whatever now occupies those reallocated pages (up to the full DMB size) straight to userspace, yielding a large arbitrary kernel-heap disclosure.\nI:H - This is a use-after-free on page-granular memory, and smc_rx_pipe_buf_release() additionally issues put_page() on a page it never referenced \u2014 once the page is recycled the folio is no longer large_kmalloc, so the refcount of an unrelated owner\u0027s page is decremented, causing a premature free and page reuse that is a well-known route to arbitrary write and privilege escalation.\nA:H - The WARN_ON_ONCE in get_page() fires (an immediate panic on the many deployments running panic_on_warn=1), and the resulting use-after-free plus page refcount underflow readily produce oopses, memory corruption, and kernel panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:04.409Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/14fc4fdae42e34d7ee871b292ac2ecc61c2c5de7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5411685dc2f6ac7bdf01a0a204d56cae38c6cf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a35c04de2565db191726b5741e6b66a35002c652"
        }
      ],
      "title": "net/smc: fix warning in smc_rx_splice() when calling get_page()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40012",
    "datePublished": "2025-10-20T15:26:57.214Z",
    "dateReserved": "2025-04-16T07:20:57.151Z",
    "dateUpdated": "2026-08-05T12:07:04.409Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40012",
      "date": "2026-09-15",
      "epss": "0.00179",
      "percentile": "0.07608"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40012\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-20T16:15:37.937\",\"lastModified\":\"2026-07-30T06:24:06.137\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: fix warning in smc_rx_splice() when calling get_page()\\n\\nsmc_lo_register_dmb() allocates DMB buffers with kzalloc(), which are\\nlater passed to get_page() in smc_rx_splice(). Since kmalloc memory is\\nnot page-backed, this triggers WARN_ON_ONCE() in get_page() and prevents\\nholding a refcount on the buffer. This can lead to use-after-free if\\nthe memory is released before splice_to_pipe() completes.\\n\\nUse folio_alloc() instead, ensuring DMBs are page-backed and safe for\\nget_page().\\n\\nWARNING: CPU: 18 PID: 12152 at ./include/linux/mm.h:1330 smc_rx_splice+0xaf8/0xe20 [smc]\\nCPU: 18 UID: 0 PID: 12152 Comm: smcapp Kdump: loaded Not tainted 6.17.0-rc3-11705-g9cf4672ecfee #10 NONE\\nHardware name: IBM 3931 A01 704 (z/VM 7.4.0)\\nKrnl PSW : 0704e00180000000 000793161032696c (smc_rx_splice+0xafc/0xe20 [smc])\\n           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3\\nKrnl GPRS: 0000000000000000 001cee80007d3001 00077400000000f8 0000000000000005\\n           0000000000000001 001cee80007d3006 0007740000001000 001c000000000000\\n           000000009b0c99e0 0000000000001000 001c0000000000f8 001c000000000000\\n           000003ffcc6f7c88 0007740003e98000 0007931600000005 000792969b2ff7b8\\nKrnl Code: 0007931610326960: af000000\\t\\tmc\\t0,0\\n           0007931610326964: a7f4ff43\\t\\tbrc\\t15,00079316103267ea\\n          #0007931610326968: af000000\\t\\tmc\\t0,0\\n          \u003e000793161032696c: a7f4ff3f\\t\\tbrc\\t15,00079316103267ea\\n           0007931610326970: e320f1000004\\tlg\\t%r2,256(%r15)\\n           0007931610326976: c0e53fd1b5f5\\tbrasl\\t%r14,000793168fd5d560\\n           000793161032697c: a7f4fbb5\\t\\tbrc\\t15,00079316103260e6\\n           0007931610326980: b904002b\\t\\tlgr\\t%r2,%r11\\nCall Trace:\\n smc_rx_splice+0xafc/0xe20 [smc]\\n smc_rx_splice+0x756/0xe20 [smc])\\n smc_rx_recvmsg+0xa74/0xe00 [smc]\\n smc_splice_read+0x1ce/0x3b0 [smc]\\n sock_splice_read+0xa2/0xf0\\n do_splice_read+0x198/0x240\\n splice_file_to_pipe+0x7e/0x110\\n do_splice+0x59e/0xde0\\n __do_splice+0x11a/0x2d0\\n __s390x_sys_splice+0x140/0x1f0\\n __do_syscall+0x122/0x280\\n system_call+0x6e/0x90\\nLast Breaking-Event-Address:\\nsmc_rx_splice+0x960/0xe20 [smc]\\n---[ end trace 0000000000000000 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/smc/smc_loopback.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f7a22071dbf316c982fb44308874bd7ad9ac2091\",\"lessThan\":\"14fc4fdae42e34d7ee871b292ac2ecc61c2c5de7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f7a22071dbf316c982fb44308874bd7ad9ac2091\",\"lessThan\":\"d5411685dc2f6ac7bdf01a0a204d56cae38c6cf6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f7a22071dbf316c982fb44308874bd7ad9ac2091\",\"lessThan\":\"a35c04de2565db191726b5741e6b66a35002c652\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/smc/smc_loopback.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.50\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.10\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/14fc4fdae42e34d7ee871b292ac2ecc61c2c5de7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a35c04de2565db191726b5741e6b66a35002c652\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d5411685dc2f6ac7bdf01a0a204d56cae38c6cf6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:31:12+00:00",
      "cve": "CVE-2025-40012",
      "id": "CVE-2025-40012",
      "initial_release_date": "2025-10-20T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: fix warning in smc_rx_splice() when calling get_page()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40012.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:33:33Z",
      "cve": "CVE-2025-40012",
      "id": "CVE-2025-40012",
      "initial_release_date": "2025-10-20T23:27:32Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "490",
      "product_status:recommended": "247",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40012",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40012.json",
      "version": "38"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.