CVE-2025-40176
Critical
Description
In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate that clone, proceeding with async decryption can lead to various issues (UAF on the skb, writing into userspace memory after the recv() call has returned). In this case, wait for all pending decryption requests.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Linux
PublishedNov 12, 2025
First seenNov 12, 2025
How to fix
Update
- Linux Linux9f83fd0c179e0f458e824e417f9d5ad53443f685, c61d4368197d65c4809d9271f3b85325a600586a, 39dec4ea3daf77f684308576baf483b55ca7f160, 4fc109d0ab196bd943b7451276690fb6bb48c2e0, b8a6ff84abbcbbc445463de58704686011edc8e1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 84c61fe1a75b4255df1e1e7c054c9e6d048da417 ≤ v < 9f83fd0c179e0f458e824e417f9d5ad53443f685, 84c61fe1a75b4255df1e1e7c054c9e6d048da417 ≤ v < c61d4368197d65c4809d9271f3b85325a600586a, 84c61fe1a75b4255df1e1e7c054c9e6d048da417 ≤ v < 39dec4ea3daf77f684308576baf483b55ca7f160, 84c61fe1a75b4255df1e1e7c054c9e6d048da417 ≤ v < 4fc109d0ab196bd943b7451276690fb6bb48c2e0, 84c61fe1a75b4255df1e1e7c054c9e6d048da417 ≤ v < b8a6ff84abbcbbc445463de58704686011edc8e1, 6.0 | 9f83fd0c179e0f458e824e417f9d5ad53443f685, c61d4368197d65c4809d9271f3b85325a600586a, 39dec4ea3daf77f684308576baf483b55ca7f160, 4fc109d0ab196bd943b7451276690fb6bb48c2e0, b8a6ff84abbcbbc445463de58704686011edc8e1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.