github - ghsa-78x4-5hh5-f94g

ghsa-78x4-5hh5-f94g

Vulnerability from github

Published

2025-11-13 00:30

Modified

2025-11-13 00:30

Details

In the Linux kernel, the following vulnerability has been resolved:

mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop

The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index for zero-indexed arrays to prevent accessing memory beyond the allocated array bounds.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-40180"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-12T22:15:44Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop\n\nThe cleanup loop was starting at the wrong array index, causing\nout-of-bounds access.\nStart the loop at the correct index for zero-indexed arrays to prevent\naccessing memory beyond the allocated array bounds.",
  "id": "GHSA-78x4-5hh5-f94g",
  "modified": "2025-11-13T00:30:17Z",
  "published": "2025-11-13T00:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40180"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0aead8197fc1a85b0a89646e418feb49a564b029"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ab96f08ecedd263ecaab9df8455bfb23b07fdcc2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cd0cbf2713f6e027ebba867cb7409ae345a31312"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2025-40180 (GCVE-0-2025-40180)

Vulnerability from cvelistv5

Published

2025-11-12 21:56

Modified

2025-11-12 21:56

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index for zero-indexed arrays to prevent accessing memory beyond the allocated array bounds.

References

URL

Tags

	https://git.kernel.org/stable/c/cd0cbf2713f6e027ebba867cb7409ae345a31312
	https://git.kernel.org/stable/c/ab96f08ecedd263ecaab9df8455bfb23b07fdcc2
	https://git.kernel.org/stable/c/0aead8197fc1a85b0a89646e418feb49a564b029

Impacted products

Vendor

Product

Version

Version: 4981b82ba2ff87df6a711fcd7a233c615df5fc79
Version: 4981b82ba2ff87df6a711fcd7a233c615df5fc79
Version: 4981b82ba2ff87df6a711fcd7a233c615df5fc79

Version: 5.1

Show details on NVD website

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/zynqmp-ipi-mailbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cd0cbf2713f6e027ebba867cb7409ae345a31312",
              "status": "affected",
              "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79",
              "versionType": "git"
            },
            {
              "lessThan": "ab96f08ecedd263ecaab9df8455bfb23b07fdcc2",
              "status": "affected",
              "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79",
              "versionType": "git"
            },
            {
              "lessThan": "0aead8197fc1a85b0a89646e418feb49a564b029",
              "status": "affected",
              "version": "4981b82ba2ff87df6a711fcd7a233c615df5fc79",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/zynqmp-ipi-mailbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18-rc1",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop\n\nThe cleanup loop was starting at the wrong array index, causing\nout-of-bounds access.\nStart the loop at the correct index for zero-indexed arrays to prevent\naccessing memory beyond the allocated array bounds."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-12T21:56:25.395Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cd0cbf2713f6e027ebba867cb7409ae345a31312"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab96f08ecedd263ecaab9df8455bfb23b07fdcc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aead8197fc1a85b0a89646e418feb49a564b029"
        }
      ],
      "title": "mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40180",
    "datePublished": "2025-11-12T21:56:25.395Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2025-11-12T21:56:25.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.