CVE-2025-40022: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
In the Linux kernel, the following vulnerability has been resolved:
crypto: afalg - Fix incorrect boolean values in afalgctx
Commit 1b34cbbf4f01 ("crypto: afalg - Disallow concurrent writes in afalgsendmsg") changed some fields from bool to 1-bit bitfields of type u32.
However, some assignments to these fields, specifically 'more' and 'merge', assign values greater than 1. These relied on C's implicit conversion to bool, such that zero becomes false and nonzero becomes true.
With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken instead, resulting in 0 being assigned in some cases when 1 was intended.
Fix this by restoring the bool type.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1Fixed in 7.3.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40022?
CVE-2025-40022 is classified as a moderate severity vulnerability affecting the Linux kernel.
What systems are affected by CVE-2025-40022?
CVE-2025-40022 affects various versions of the Linux kernel across different distributions.
How do I fix CVE-2025-40022?
To fix CVE-2025-40022, update your Linux kernel to the latest stable version where the vulnerability has been addressed.
What is the nature of CVE-2025-40022?
CVE-2025-40022 involves a flaw in the af_alg module of the Linux kernel related to incorrect boolean values.
How can I check if my system is vulnerable to CVE-2025-40022?
You can check your Linux kernel version and compare it against the patched versions for CVE-2025-40022 to determine vulnerability.