CVE-2025-40236
Unknown
Description
In the Linux kernel, the following vulnerability has been resolved: virtio-net: zero unused hash fields When GSO tunnel is negotiated virtio_net_hdr_tnl_from_skb() tries to initialize the tunnel metadata but forget to zero unused rxhash fields. This may leak information to another side. Fixing this by zeroing the unused hash fields.
SeverityUnknown
CVSS—
Exploit probability10. percentile0.2%
Product
Linux
PublishedDec 4, 2025
First seenDec 4, 2025
How to fix
Update
- Linux Linuxb625d231c66a6041e98817ffc944bf6e4c45b2e3, b2284768c6b32aa224ca7d0ef0741beb434f03aa or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | a2fb4bc4e2a6a031683910d85b278c1d25ae5420 ≤ v < b625d231c66a6041e98817ffc944bf6e4c45b2e3, a2fb4bc4e2a6a031683910d85b278c1d25ae5420 ≤ v < b2284768c6b32aa224ca7d0ef0741beb434f03aa, 6.17 | b625d231c66a6041e98817ffc944bf6e4c45b2e3, b2284768c6b32aa224ca7d0ef0741beb434f03aa |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.