CVE-2025-40035
Unknown
Description
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields.
SeverityUnknown
CVSS—
Exploit probability—
Product
Linux
PublishedOct 28, 2025
First seenOct 28, 2025
How to fix
Update
- Linux Linux1b317796013f666ae5040edbf0f230ec61496d42, 877172b97786ed1678640dff0b2d35abb328844c, e63aade22a33e77b93c98c9f02db504d897a76b4, 933b87c4590b42500299f00ff55f555903056803, fd8a23ecbc602d00e47b27f20b07350867d0ebe5, 48c96b7e9e03516936d6deba54b5553097eae817, f5e1f3b85aadce74268c46676772c3e9fa79897e, d3366a04770eea807f2826cbdb96934dd8c9bf79 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 2d56f3a32c0e62f99c043d2579840f9731fe5855 ≤ v < 1b317796013f666ae5040edbf0f230ec61496d42, 2d56f3a32c0e62f99c043d2579840f9731fe5855 ≤ v < 877172b97786ed1678640dff0b2d35abb328844c, 2d56f3a32c0e62f99c043d2579840f9731fe5855 ≤ v < e63aade22a33e77b93c98c9f02db504d897a76b4, 2d56f3a32c0e62f99c043d2579840f9731fe5855 ≤ v < 933b87c4590b42500299f00ff55f555903056803, 2d56f3a32c0e62f99c043d2579840f9731fe5855 ≤ v < fd8a23ecbc602d00e47b27f20b07350867d0ebe5, 2d56f3a32c0e62f99c043d2579840f9731fe5855 ≤ v < 48c96b7e9e03516936d6deba54b5553097eae817, 2d56f3a32c0e62f99c043d2579840f9731fe5855 ≤ v < f5e1f3b85aadce74268c46676772c3e9fa79897e, 2d56f3a32c0e62f99c043d2579840f9731fe5855 ≤ v < d3366a04770eea807f2826cbdb96934dd8c9bf79, 2.6.29 | 1b317796013f666ae5040edbf0f230ec61496d42, 877172b97786ed1678640dff0b2d35abb328844c, e63aade22a33e77b93c98c9f02db504d897a76b4, 933b87c4590b42500299f00ff55f555903056803, fd8a23ecbc602d00e47b27f20b07350867d0ebe5, 48c96b7e9e03516936d6deba54b5553097eae817, f5e1f3b85aadce74268c46676772c3e9fa79897e, d3366a04770eea807f2826cbdb96934dd8c9bf79 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.