CVE-2025-40035: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak

Q: What is the severity of CVE-2025-40035?

The severity of CVE-2025-40035 is not explicitly rated, but it addresses an information leak vulnerability in the Linux kernel.

Q: How do I fix CVE-2025-40035?

To fix CVE-2025-40035, ensure that your Linux kernel is updated to the latest version that includes the patch for this vulnerability.

Q: What systems are affected by CVE-2025-40035?

CVE-2025-40035 affects the Linux kernel across various distributions that run vulnerable versions.

Q: What does CVE-2025-40035 exploit?

CVE-2025-40035 exploits an information leak due to improper initialization of padding in struct ff_effect_compat.

Q: Is CVE-2025-40035 a critical vulnerability?

While CVE-2025-40035 is important to address, it is not classified as critical but still poses a risk of information exposure.

Published Oct 28, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

Input: uinput - zero-initialize uinputffuploadcompat to avoid info leak

Struct ffeffectcompat is embedded twice inside uinputffuploadcompat, contains internal padding. In particular, there is a hole after struct ffreplay to satisfy alignment requirements for the following union member. Without clearing the structure, copytouser() may leak stack data to userspace.

Initialize ffupcompat to zero before filling valid fields.

Affected Software

242 affected componentsFixes available

Linux Linux kernel

Microsoft azl3 kernel 6.6.104.2-4

Patch available

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-lts-xenial*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm*

ubuntu/linux-oracle*

ubuntu/linux-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1100.107~20.04.2

5.15.0-1100.107~20.04.2

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1110.119~20.04.1

5.15.0-1110.119~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1100.109~20.04.1

5.15.0-1100.109~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-170.180~20.04.3

5.15.0-170.180~20.04.3

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15<5.15.0-1094.97~20.04.1

5.15.0-1094.97~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1095.101~20.04.1

5.15.0-1095.101~20.04.1

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-170.180~20.04.1

5.15.0-170.180~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1052.52~20.04.2

5.15.0-1052.52~20.04.2

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1097.103~20.04.1

5.15.0-1097.103~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1095.99~20.04.1

5.15.0-1095.99~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-170.180

5.15.0-170.180

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1100.107

5.15.0-1100.107

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1050.53~22.04.1

6.8.0-1050.53~22.04.1

ubuntu/linux-azure<5.15.0-1109.118

5.15.0-1109.118

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1051.57~22.04.1

6.8.0-1051.57~22.04.1

ubuntu/linux-azure-fde<5.15.0-1109.118.1

5.15.0-1109.118.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1058.65~22.04.1

6.8.0-1058.65~22.04.1

ubuntu/linux-gcp<5.15.0-1100.109

5.15.0-1100.109

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1052.55~22.04.1

6.8.0-1052.55~22.04.1

ubuntu/linux-gke<5.15.0-1096.102

5.15.0-1096.102

ubuntu/linux-gkeop<5.15.0-1083.91

5.15.0-1083.91

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-106.106~22.04.1

6.8.0-106.106~22.04.1

ubuntu/linux-ibm<5.15.0-1094.97

5.15.0-1094.97

ubuntu/linux-ibm-6.8<6.8.0-1049.49~22.04.1

6.8.0-1049.49~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1095.101

5.15.0-1095.101

ubuntu/linux-kvm<5.15.0-1092.97

5.15.0-1092.97

ubuntu/linux-lowlatency<5.15.0-170.180

5.15.0-170.180

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-106.106.1~22.04.1

6.8.0-106.106.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1095.96

5.15.0-1095.96

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1049.52~22.04.1

6.8.0-1049.52~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1052.52

5.15.0-1052.52

ubuntu/linux-nvidia-tegra-igx<5.15.0-1041.41

5.15.0-1041.41

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1097.103

5.15.0-1097.103

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1047.48~22.04.1

6.8.0-1047.48~22.04.1

ubuntu/linux-raspi<5.15.0-1097.100

5.15.0-1097.100

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-106.106~22.04.1

6.8.0-106.106~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1064.68

5.15.0-1064.68

ubuntu/linux-bluefield<5.15.0-1084.86

5.15.0-1084.86

ubuntu/linux-intel-iot-realtime<5.15.0-1092.94

5.15.0-1092.94

ubuntu/linux-realtime<5.15.0-1099.108

5.15.0-1099.108

ubuntu/linux-realtime-6.8<6.8.1-1045.46~22.04.1

6.8.1-1045.46~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1100.107+fips1

5.15.0-1100.107+fips1

ubuntu/linux-azure-fips<5.15.0-1109.118+fips1

5.15.0-1109.118+fips1

ubuntu/linux-fips<5.15.0-170.180+fips1

5.15.0-170.180+fips1

ubuntu/linux-gcp-fips<5.15.0-1100.109+fips1

5.15.0-1100.109+fips1

ubuntu/linux<6.8.0-106.106

6.8.0-106.106

ubuntu/linux-aws<6.8.0-1050.53

6.8.0-1050.53

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17<6.17.0-1007.7~24.04.1

6.17.0-1007.7~24.04.1

ubuntu/linux-azure<6.8.0-1051.57

6.8.0-1051.57

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-fde<6.8.0-1058.65

6.8.0-1058.65

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1052.55

6.8.0-1052.55

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1008.8~24.04.1

6.17.0-1008.8~24.04.1

ubuntu/linux-gke<6.8.0-1048.53

6.8.0-1048.53

ubuntu/linux-gkeop<6.8.0-1035.38

6.8.0-1035.38

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-ibm<6.8.0-1049.49

6.8.0-1049.49

ubuntu/linux-lowlatency<6.8.0-106.106.1

6.8.0-106.106.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1049.52

6.8.0-1049.52

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1008.8

6.17.0-1008.8

ubuntu/linux-nvidia-lowlatency<6.8.0-1049.52.1

6.8.0-1049.52.1

ubuntu/linux-nvidia-tegra<6.8.0-1020.20

6.8.0-1020.20

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1011.11

6.17.0-1011.11

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1047.48

6.8.0-1047.48

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1007.7~24.04.1

6.17.0-1007.7~24.04.1

ubuntu/linux-raspi<6.8.0-1050.54

6.8.0-1050.54

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-xilinx<6.8.0-1028.29

6.8.0-1028.29

ubuntu/linux-bluefield<6.8.0-1017.21

6.8.0-1017.21

ubuntu/linux-raspi-realtime<6.8.0-2040.41

6.8.0-2040.41

ubuntu/linux-realtime<6.8.1-1045.46

6.8.1-1045.46

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1006.7~24.04.1

6.17.0-1006.7~24.04.1

ubuntu/linux-aws-fips<6.8.0-1050.53+fips1

6.8.0-1050.53+fips1

ubuntu/linux-azure-fips<6.8.0-1052.58+fips1

6.8.0-1052.58+fips1

ubuntu/linux-fips<6.8.0-106.106+fips1

6.8.0-106.106+fips1

ubuntu/linux-gcp-fips<6.8.0-1052.55+fips1

6.8.0-1052.55+fips1

ubuntu/linux<6.17.0-14.14

6.17.0-14.14

ubuntu/linux-aws<6.17.0-1007.7

6.17.0-1007.7

ubuntu/linux-azure<6.17.0-1008.8

6.17.0-1008.8

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<6.17.0-1007.7

6.17.0-1007.7

ubuntu/linux-oracle<6.17.0-1007.7

6.17.0-1007.7

ubuntu/linux-raspi<6.17.0-1008.8

6.17.0-1008.8

ubuntu/linux-realtime<6.17.0-1006.7

6.17.0-1006.7

ubuntu/linux-riscv<6.17.0-14.14.1

6.17.0-14.14.1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.15-17.3.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.107~20.04.2
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1110.119~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.109~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180~20.04.3
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.97~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.101~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.52~20.04.2
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.103~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.99~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.107
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.118
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.57~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.118.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.109
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.55~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.102
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1083.91
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.97
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.49~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.101
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.97
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.96
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.52~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.52
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1041.41
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.103
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.48~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.100
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1064.68
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1084.86
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.94
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1099.108
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1045.46~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.107+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.118+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.109+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53
Upgrade
Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.57
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.55
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1048.53
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1035.38
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.49
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.52
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.52.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.20
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.11
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.48
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.54
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.29
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.21
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2040.41
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1045.46
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1006.7~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.58+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-106.106+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.55+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.17.0-14.14
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.17.0-1006.7
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.17.0-14.14.1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1Fixed in 7.3.3-1
Compensating control
Zero-initialize uinput_ff_upload_compat (ff_up_compat) before filling valid fields so internal padding in the embedded ff_effect_compat structures cannot leak stack data through copy_to_user().

Event History

Oct 28, 2025

CVE Published

via MITRE·11:48 AM

Data Sourced

via MITRE·11:48 AM

Description

Data Sourced

via OSV·12:15 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·12:15 PM

Description

Oct 29, 2025

Data Sourced

via Microsoft·01:02 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6053

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2025-40035?

The severity of CVE-2025-40035 is not explicitly rated, but it addresses an information leak vulnerability in the Linux kernel.

How do I fix CVE-2025-40035?

To fix CVE-2025-40035, ensure that your Linux kernel is updated to the latest version that includes the patch for this vulnerability.

What systems are affected by CVE-2025-40035?

CVE-2025-40035 affects the Linux kernel across various distributions that run vulnerable versions.

What does CVE-2025-40035 exploit?

CVE-2025-40035 exploits an information leak due to improper initialization of padding in struct ff_effect_compat.

Is CVE-2025-40035 a critical vulnerability?

While CVE-2025-40035 is important to address, it is not classified as critical but still poses a risk of information exposure.

CVE-2025-40035: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-40035?

How do I fix CVE-2025-40035?

What systems are affected by CVE-2025-40035?

What does CVE-2025-40035 exploit?

Is CVE-2025-40035 a critical vulnerability?

Company

Resources

Contact