vulnerability
Red Hat: CVE-2025-40248: kernel: Linux kernel: vsock vulnerability may lead to memory corruption (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:L/AC:M/Au:S/C:C/I:C/A:C) | Dec 4, 2025 | Jan 27, 2026 | Feb 4, 2026 |
Severity
7
CVSS
(AV:L/AC:M/Au:S/C:C/I:C/A:C)
Published
Dec 4, 2025
Added
Jan 27, 2026
Modified
Feb 4, 2026
Description
A flaw was found in the Linux kernel's `vsock` component. This vulnerability occurs when a `connect()` operation on an already established socket is interrupted by a signal or timeout, causing the system to mishandle the socket's state. This incorrect handling can lead to a race condition, potentially resulting in memory corruption, such as a use-after-free or null-pointer dereference. A local attacker could exploit this to cause a denial of service or potentially escalate privileges.
Solutions
redhat-upgrade-kernelredhat-upgrade-kernel-rt
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.