CVE-2025-40063: crypto: comp - Use same definition of context alloc and free ops

Published Oct 28, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

crypto: comp - Use same definition of context alloc and free ops

In commit 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp"), the cryptoacompstreams struct was made to rely on having the allocctx and freectx operations defined in the same order as the scompalg struct. But in that same commit, the allocctx and freectx members of scompalg may be randomized by structure layout randomization, since they are contained in a pure ops structure (containing only function pointers). If the pointers within scompalg are randomized, but those in cryptoacompstreams are not, then the order may no longer match. This fixes the problem by removing the union from scompalg so that both cryptoacompstreams and scompalg will share the same definition of allocctx and freectx, ensuring they will always have the same layout.

Affected Software

1 affected component
Linux Linux kernel

Event History

Oct 28, 2025
CVE Published
via MITRE·11:48 AM
Data Sourced
via MITRE·11:48 AM
DescriptionSeverity
Data Sourced
via NVD·12:15 PM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2025-40063?

CVE-2025-40063 has been classified as a low severity vulnerability in the Linux kernel.

2

What types of systems are affected by CVE-2025-40063?

CVE-2025-40063 specifically affects systems running the Linux kernel.

3

How do I fix CVE-2025-40063?

To remediate CVE-2025-40063, update your Linux kernel to the latest stable version that addresses this vulnerability.

4

What is the nature of the vulnerability in CVE-2025-40063?

CVE-2025-40063 involves an issue in the crypto subsystem of the Linux kernel related to context allocation and deallocation.

5

Was there a patch released for CVE-2025-40063?

Yes, a patch addressing CVE-2025-40063 has been included in recent updates of the Linux kernel.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203