CVE-2025-40262 (GCVE-0-2025-40262)
Vulnerability from cvelistv5
Published
2025-12-04 16:08
Modified
2026-08-05 12:09
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &.
References
Impacted products
Vendor Product Version
Linux Linux Version: 768062fd1284529212daffd360314e9aa93abb62
Version: 768062fd1284529212daffd360314e9aa93abb62
Version: 768062fd1284529212daffd360314e9aa93abb62
Version: 768062fd1284529212daffd360314e9aa93abb62
Version: 768062fd1284529212daffd360314e9aa93abb62
Version: 768062fd1284529212daffd360314e9aa93abb62
Version: 768062fd1284529212daffd360314e9aa93abb62
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:13.905Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/keyboard/imx_sc_key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e96803b169dc948847f0fc2bae729a80914eb7b",
              "status": "affected",
              "version": "768062fd1284529212daffd360314e9aa93abb62",
              "versionType": "git"
            },
            {
              "lessThan": "4ce5218b101205b3425099fe3df88a61b58f9cc2",
              "status": "affected",
              "version": "768062fd1284529212daffd360314e9aa93abb62",
              "versionType": "git"
            },
            {
              "lessThan": "a155292c3ce722036014da5477ee0e4c87b5e6b3",
              "status": "affected",
              "version": "768062fd1284529212daffd360314e9aa93abb62",
              "versionType": "git"
            },
            {
              "lessThan": "ca9a08de9b294422376f47ade323d69590dbc6f2",
              "status": "affected",
              "version": "768062fd1284529212daffd360314e9aa93abb62",
              "versionType": "git"
            },
            {
              "lessThan": "56881294915a6e866d31a46f9bcb5e19167cfbaa",
              "status": "affected",
              "version": "768062fd1284529212daffd360314e9aa93abb62",
              "versionType": "git"
            },
            {
              "lessThan": "6524a15d33951b18ac408ebbcb9c16e14e21c336",
              "status": "affected",
              "version": "768062fd1284529212daffd360314e9aa93abb62",
              "versionType": "git"
            },
            {
              "lessThan": "d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4",
              "status": "affected",
              "version": "768062fd1284529212daffd360314e9aa93abb62",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/keyboard/imx_sc_key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: imx_sc_key - fix memory corruption on unload\n\nThis is supposed to be \"priv\" but we accidentally pass \"\u0026priv\" which is\nan address in the stack and so it will lead to memory corruption when\nthe imx_sc_key_action() function is called.  Remove the \u0026."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The corrupted teardown is reached through local operations on the platform device (module unload, sysfs driver unbind, or automatic devres unwind on probe failure), not through any network or remote data path. No physical hardware access is needed to initiate it.\nAC:L - The wrong pointer is passed unconditionally on every probe, so the corrupt teardown is fully deterministic with no race to win. Turning the subsequent freed-`priv` notifier/work UAF into a controlled call is standard heap grooming the attacker performs from userspace.\nPR:L - The teardown path is normally entered by driver unbind/module unload, and the identical corrupted action also executes automatically on the probe-failure unwind with no privilege at all; a local unprivileged process supplies the slab contents that the freed `priv` is reallocated into. Scored at the higher-severity option consistent with kernel CNA treatment of devres-lifetime corruption.\nUI:N - No victim action is required \u2014 unbind/unload or probe-failure unwind executes the bad devres action directly, and the resulting stale notifier is invoked by ordinary SCU interrupt activity.\nS:U - The corruption and the resulting use-after-free are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `notifier_block` and `delayed_work` live in freed devm_kzalloc memory that an attacker can reallocate and shape, and the wild pointer reads reused kernel stack memory, giving a path to disclose arbitrary kernel data.\nI:H - `cancel_delayed_work_sync()` performs writes (`atomic_long_set` on `work-\u003edata`, timer/worker list manipulation) through an unrelated stale stack address, and the never-unregistered notifier yields an indirect call through a function pointer read from freed slab memory \u2014 both usable for control-flow hijacking.\nA:H - Operating on a garbage `timer_list`/`work_struct` and later walking a notifier chain containing freed memory reliably produces an oops or panic, and the flush path can hang on a bogus work item."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:00.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e96803b169dc948847f0fc2bae729a80914eb7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ce5218b101205b3425099fe3df88a61b58f9cc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a155292c3ce722036014da5477ee0e4c87b5e6b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca9a08de9b294422376f47ade323d69590dbc6f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/56881294915a6e866d31a46f9bcb5e19167cfbaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/6524a15d33951b18ac408ebbcb9c16e14e21c336"
        },
        {
          "url": "https://git.kernel.org/stable/c/d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4"
        }
      ],
      "title": "Input: imx_sc_key - fix memory corruption on unload",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40262",
    "datePublished": "2025-12-04T16:08:22.043Z",
    "dateReserved": "2025-04-16T07:20:57.182Z",
    "dateUpdated": "2026-08-05T12:09:00.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.