CVE-2025-40331

sctp: Prevent TOCTOU out-of-bounds write

State: Published
Severity: 7.8 High
Published: Dec 9, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: Prevent TOCTOU out-of-bounds write

For the following path not holding the sock lock,

sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()

make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use).

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8f840e47f190cbe61a96945c13e9551048d42cef to before b106a68df0650b694b254427cd9250c04500edd3Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before 3006959371007fc2eae4a078f823c680fa52de1aAffected 8f840e47f190cbe61a96945c13e9551048d42cef to before 72e3fea68eac8d088e44c3dd954e843478e9240eAffected 8f840e47f190cbe61a96945c13e9551048d42cef to before 584307275b2048991b2e8984962189b6cc0a9b85Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before c9119f243d9c0da3c3b5f577a328de3e7ffd1b42Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before 2fe08fcaacb7eb019fa9c81db39b2214de216677Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before 89eac1e150dbd42963e13d23828cb8c4e0763196Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before 95aef86ab231f047bb8085c70666059b58f53c09Affected
LinuxLinux	4.7Affected before 4.7Not affected 5.4.302 through 5.4.Not affected 5.10.247 through 5.10.Not affected 5.15.197 through 5.15.Not affected 6.1.159 through 6.1.Not affected 6.6.117 through 6.6.Not affected 6.12.58 through 6.12.Not affected 6.17.8 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

8f840e47f190cbe61a96945c13e9551048d42cef to before b106a68df0650b694b254427cd9250c04500edd3Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before 3006959371007fc2eae4a078f823c680fa52de1aAffected
8f840e47f190cbe61a96945c13e9551048d42cef to before 72e3fea68eac8d088e44c3dd954e843478e9240eAffected
8f840e47f190cbe61a96945c13e9551048d42cef to before 584307275b2048991b2e8984962189b6cc0a9b85Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before c9119f243d9c0da3c3b5f577a328de3e7ffd1b42Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before 2fe08fcaacb7eb019fa9c81db39b2214de216677Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before 89eac1e150dbd42963e13d23828cb8c4e0763196Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before 95aef86ab231f047bb8085c70666059b58f53c09Affected

LinuxLinux

4.7Affected
before 4.7Not affected
5.4.302 through 5.4.*Not affected
5.10.247 through 5.10.*Not affected
5.15.197 through 5.15.*Not affected
6.1.159 through 6.1.*Not affected
6.6.117 through 6.6.*Not affected
6.12.58 through 6.12.*Not affected
6.17.8 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.