CVE-2025-40236: virtio-net: zero unused hash fields
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: zero unused hash fields
When GSO tunnel is negotiated virtionethdrtnlfromskb() tries to initialize the tunnel metadata but forget to zero unused rxhash fields. This may leak information to another side. Fixing this by zeroing the unused hash fields.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40236?
CVE-2025-40236 has a medium severity rating due to potential information leakage.
How do I fix CVE-2025-40236?
To fix CVE-2025-40236, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2025-40236?
CVE-2025-40236 affects various versions of the Linux kernel prior to the patch being applied.
What does CVE-2025-40236 exploit?
CVE-2025-40236 exploits a flaw in the virtio-net handling of the tunnel metadata, which may lead to information leakage.
Who is the vendor associated with CVE-2025-40236?
The vendor associated with CVE-2025-40236 is the Linux development community responsible for the Linux kernel.