8.5

CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption

Deferred
AliasesUBUNTU-CVE-2025-40019DEBIAN-CVE-2025-40019
Published 24-10-2025Last modified 11-05-2026

Vulnerability summary

CVE-2025-40019 is a high (CVSS 8.5) vulnerability in linux. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.5/10
010
High · v4.0 (OSV · Ubuntu), selected by version preference
EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 49 · Related 44
DLA-4379-1DLA-4404-1DSA-6053-1MGASA-2025-0309MGASA-2025-0310OPENSUSE-SU-2025:15702-1

Timeline

  1. 24-10-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.29% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu149 products
  • linux< 5.4.0-225.245 | < 5.15.0-168.178 | < 6.8.0-94.96 | < 6.17.0-12.12
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.4.0-1154.164 | < 5.15.0-1099.106 | < 6.8.0-1045.47 | < 6.17.0-1006.6
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.158-1 | < 6.12.57-1 | < 6.17.6-1
Linux1 product
  • linux≥ be1eb7f78aa8fbe34779c56c266ccd0364604e71, < 29294dd6f1e7acf527255fb136ffde6602c3a129 | ≥ be1eb7f78aa8fbe34779c56c266ccd0364604e71, < 71f03f8f72d9c70ffba76980e78b38c180e61589 | ≥ be1eb7f78aa8fbe34779c56c266ccd0364604e71, < df58651968f82344a0ed2afdafd20ecfc55ff548 | ≥ be1eb7f78aa8fbe34779c56c266ccd0364604e71, < 248ff2797ff52a8cbf86507f9583437443bf7685 | ≥ be1eb7f78aa8fbe34779c56c266ccd0364604e71, < f37e7860dc5e94c70b4a3e38a5809181310ea9ac | ≥ be1eb7f78aa8fbe34779c56c266ccd0364604e71, < dc4c854a5e7453c465fa73b153eba4ef2a240abe | ≥ be1eb7f78aa8fbe34779c56c266ccd0364604e71, < da7afb01ba05577ba3629f7f4824205550644986 | ≥ be1eb7f78aa8fbe34779c56c266ccd0364604e71, < 6bb73db6948c2de23e407fe1b7ef94bf02b7529f | 5.4

3 vendors · 151 products

References

34 links
Show all 34 references