CVE-2025-40259: linux

CVSS: UnknownDeferred
AliasesUBUNTU-CVE-2025-40259DEBIAN-CVE-2025-40259
Published 04-12-2025Last modified 16-06-2026
Open JSON

Vulnerability summary

CVE-2025-40259 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.4% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.20%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 44 · Related 40
DLA-4404-1DLA-4436-1MGASA-2026-0017MGASA-2026-0018OPENSUSE-SU-2026:20287-1SUSE-SU-2026:0447-1

Timeline

  1. 04-12-2025
    PublishedVulnerability first disclosed.
  2. 16-06-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Do not sleep in atomic context sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disabled.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

0.00 pp

From 0.20% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu156 products
  • linuxAll versions (No fix recorded) | < 5.15.0-173.183 | < 6.8.0-106.106 | < 6.17.0-19.19
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1103.110 | < 6.8.0-1050.53 | < 6.17.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.159-1 | < 6.12.63-1 | < 6.17.10-1
Linux1 product
  • linux≥ 97d27b0dd015e980ade63fda111fd1353276e28b, < 11eeee00c94d770d4e45364060b5f1526dfe567b | ≥ 97d27b0dd015e980ade63fda111fd1353276e28b, < db6ac8703ab2b473e1ec845f57f6dd961a388d9f | ≥ 97d27b0dd015e980ade63fda111fd1353276e28b, < 109afbd88ecc46b6cc7551367222387e97999765 | ≥ 97d27b0dd015e980ade63fda111fd1353276e28b, < 3dfd520c3b4ffe69e0630c580717d40447ab842f | ≥ 97d27b0dd015e980ade63fda111fd1353276e28b, < b343cee5df7e750d9033fba33e96fc4399fa88a5 | ≥ 97d27b0dd015e980ade63fda111fd1353276e28b, < b2c0340cfa25c5c1f65e8590cc1a2dc97d14ef0f | ≥ 97d27b0dd015e980ade63fda111fd1353276e28b, < 6983d8375c040bb449d2187f4a57a20de01244fe | ≥ 97d27b0dd015e980ade63fda111fd1353276e28b, < 90449f2d1e1f020835cba5417234636937dd657e | 8d1f3b474a89b42f957ba3bae959dd3cd16531ca | fa55ef3f803fc7c20be0ab809e6278c31febd875 | 6af37613289cfd32516ada47e444b48a638829c8 | 4a8e8e0af9a520a685e0ab2d489327d5220d7ce2 | ae9b6ae2e77947534e255903627cc62746ea77e2 | ≥ 3.16.85, < 3.17 | ≥ 3.18.101, < 3.19 | ≥ 4.1.52, < 4.2 | ≥ 4.4.123, < 4.5 | ≥ 4.9.89, < 4.10 | 4.12

3 vendors · 158 products

References

39 links
Show all 39 references