CVE-2025-40063: crypto: comp - Use same definition of context alloc and free ops
In the Linux kernel, the following vulnerability has been resolved:
crypto: comp - Use same definition of context alloc and free ops
In commit 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp"), the cryptoacompstreams struct was made to rely on having the allocctx and freectx operations defined in the same order as the scompalg struct. But in that same commit, the allocctx and freectx members of scompalg may be randomized by structure layout randomization, since they are contained in a pure ops structure (containing only function pointers). If the pointers within scompalg are randomized, but those in cryptoacompstreams are not, then the order may no longer match. This fixes the problem by removing the union from scompalg so that both cryptoacompstreams and scompalg will share the same definition of allocctx and freectx, ensuring they will always have the same layout.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40063?
CVE-2025-40063 has been classified as a low severity vulnerability in the Linux kernel.
What types of systems are affected by CVE-2025-40063?
CVE-2025-40063 specifically affects systems running the Linux kernel.
How do I fix CVE-2025-40063?
To remediate CVE-2025-40063, update your Linux kernel to the latest stable version that addresses this vulnerability.
What is the nature of the vulnerability in CVE-2025-40063?
CVE-2025-40063 involves an issue in the crypto subsystem of the Linux kernel related to context allocation and deallocation.
Was there a patch released for CVE-2025-40063?
Yes, a patch addressing CVE-2025-40063 has been included in recent updates of the Linux kernel.