Log in Start free

Vulnerability · Published Nov 12, 2025 · Assigned by Linux

CVE-2025-40202ipmi: Rework user message limit handling

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 95.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all done to handle more in the receive message allocation routine, so all refcouting and user message limit counts are done in that routine. It's a lot cleaner and safer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.158-1DEBIAN-CVE-2025-40202
Debian:13linux6.12.57-1DEBIAN-CVE-2025-40202
Debian:14linux6.17.6-1DEBIAN-CVE-2025-40202
Ubuntu:24.04:LTSlinux6.8.0-106.106UBUNTU-CVE-2025-40202
Ubuntu:25.10linux6.17.0-14.14UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-aws6.8.0-1050.53UBUNTU-CVE-2025-40202
Ubuntu:25.10linux-aws6.17.0-1007.7UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-aws-6.176.17.0-1007.7~24.04.1UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1050.53~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-azure6.8.0-1051.57UBUNTU-CVE-2025-40202
Ubuntu:25.10linux-azure6.17.0-1008.8UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1051.57~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1058.65UBUNTU-CVE-2025-40202
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1058.65~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-gcp6.8.0-1052.55UBUNTU-CVE-2025-40202
Ubuntu:25.10linux-gcp6.17.0-1007.7UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1008.8~24.04.1UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1052.55~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-gke6.8.0-1048.53UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1035.38UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-106.106~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-ibm6.8.0-1049.49UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1049.49~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-106.106.1UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-106.106.1~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1049.52UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1008.8UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1049.52~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1049.52.1UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1020.20UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1011.11UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-oracle6.8.0-1047.48UBUNTU-CVE-2025-40202
Ubuntu:25.10linux-oracle6.17.0-1007.7UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1007.7~24.04.1UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1047.48~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-raspi6.8.0-1050.54UBUNTU-CVE-2025-40202
Ubuntu:25.10linux-raspi6.17.0-1008.8UBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-40202
Ubuntu:25.10linux-realtime6.17.0-1006.7UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-40202
Ubuntu:25.10linux-riscv6.17.0-14.14.1UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-106.106~22.04.1UBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-40202
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-40202
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1028.29UBUNTU-CVE-2025-40202

Affected products (as reported)

VendorProductVersions
Linux Linux 8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 – before f63723ca7d7623f9dae1990973cd158671f03c568e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 – before 348121b29594d42d1635648fd3ed31dfa25351d58e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 – before 53d6e403affbf6df2c859a0ea00ccfc1e72090ca8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 – before 0ed73be9a2547ffb9b5c1d879ad9bfab73d920b58e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 – before b52da4054ee0bf9ecb44996f2c83236ff50b3812
Linux Linux 5.19

References