{"api_version":"1","generated_at":"2026-07-23T14:01:10+00:00","cve":"CVE-2025-40278","urls":{"html":"https://cve.report/CVE-2025-40278","api":"https://cve.report/api/cve/CVE-2025-40278.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-40278","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-40278"},"summary":{"title":"net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak\n\nFix a KMSAN kernel-infoleak detected  by the syzbot .\n\n[net?] KMSAN: kernel-infoleak in __skb_datagram_iter\n\nIn tcf_ife_dump(), the variable 'opt' was partially initialized using a\ndesignatied initializer. While the padding bytes are reamined\nuninitialized. nla_put() copies the entire structure into a\nnetlink message, these uninitialized bytes leaked to userspace.\n\nInitialize the structure with memset before assigning its fields\nto ensure all members and padding are cleared prior to beign copied.\n\nThis change silences the KMSAN report and prevents potential information\nleaks from the kernel memory.\n\nThis fix has been tested and validated by syzbot. This patch closes the\nbug reported at the following syzkaller link and ensures no infoleak.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-12-06 22:15:55","updated_at":"2026-06-02 14:16:33"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/918e063304f945fb93be9bb70cacea07d0b730ea","name":"https://git.kernel.org/stable/c/918e063304f945fb93be9bb70cacea07d0b730ea","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/37f0680887c5aeba9a433fe04b35169010568bb1","name":"https://git.kernel.org/stable/c/37f0680887c5aeba9a433fe04b35169010568bb1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d1dbbbe839647486c9b893e5011fe84a052962df","name":"https://git.kernel.org/stable/c/d1dbbbe839647486c9b893e5011fe84a052962df","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a676a296af65d33725bdf7396803180957dbd92e","name":"https://git.kernel.org/stable/c/a676a296af65d33725bdf7396803180957dbd92e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2191662058443e0bcc28d11694293d8339af6dde","name":"https://git.kernel.org/stable/c/2191662058443e0bcc28d11694293d8339af6dde","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c8f51dad94cbb88054e2aacc272b3ce1ed11fb1e","name":"https://git.kernel.org/stable/c/c8f51dad94cbb88054e2aacc272b3ce1ed11fb1e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5e3644ef147bf7140259dfa4cace680c9b26fe8b","name":"https://git.kernel.org/stable/c/5e3644ef147bf7140259dfa4cace680c9b26fe8b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ce50039be49eea9b4cd8873ca6eccded1b4a130a","name":"https://git.kernel.org/stable/c/ce50039be49eea9b4cd8873ca6eccded1b4a130a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40278","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40278","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 918e063304f945fb93be9bb70cacea07d0b730ea git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 5e3644ef147bf7140259dfa4cace680c9b26fe8b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 37f0680887c5aeba9a433fe04b35169010568bb1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 2191662058443e0bcc28d11694293d8339af6dde git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 a676a296af65d33725bdf7396803180957dbd92e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 d1dbbbe839647486c9b893e5011fe84a052962df git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 c8f51dad94cbb88054e2aacc272b3ce1ed11fb1e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 ce50039be49eea9b4cd8873ca6eccded1b4a130a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.6","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.6 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.302 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.247 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.197 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.159 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.117 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.59 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17.9 6.17.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18 * original_commit_for_fix","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM RST2428P","version":"affected V4.0 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"40278","cve":"CVE-2025-40278","epss":"0.001450000","percentile":"0.345670000","score_date":"2026-06-08","updated_at":"2026-06-09 00:12:52"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"affected":[{"defaultStatus":"unknown","product":"RUGGEDCOM RST2428P","vendor":"Siemens","versions":[{"lessThan":"V4.0","status":"affected","version":"0","versionType":"custom"}]}],"providerMetadata":{"dateUpdated":"2026-06-02T13:00:18.583Z","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP"},"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}],"x_adpType":"supplier"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/act_ife.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"918e063304f945fb93be9bb70cacea07d0b730ea","status":"affected","version":"ef6980b6becb1afd9d82a4f043749a10ae81bf14","versionType":"git"},{"lessThan":"5e3644ef147bf7140259dfa4cace680c9b26fe8b","status":"affected","version":"ef6980b6becb1afd9d82a4f043749a10ae81bf14","versionType":"git"},{"lessThan":"37f0680887c5aeba9a433fe04b35169010568bb1","status":"affected","version":"ef6980b6becb1afd9d82a4f043749a10ae81bf14","versionType":"git"},{"lessThan":"2191662058443e0bcc28d11694293d8339af6dde","status":"affected","version":"ef6980b6becb1afd9d82a4f043749a10ae81bf14","versionType":"git"},{"lessThan":"a676a296af65d33725bdf7396803180957dbd92e","status":"affected","version":"ef6980b6becb1afd9d82a4f043749a10ae81bf14","versionType":"git"},{"lessThan":"d1dbbbe839647486c9b893e5011fe84a052962df","status":"affected","version":"ef6980b6becb1afd9d82a4f043749a10ae81bf14","versionType":"git"},{"lessThan":"c8f51dad94cbb88054e2aacc272b3ce1ed11fb1e","status":"affected","version":"ef6980b6becb1afd9d82a4f043749a10ae81bf14","versionType":"git"},{"lessThan":"ce50039be49eea9b4cd8873ca6eccded1b4a130a","status":"affected","version":"ef6980b6becb1afd9d82a4f043749a10ae81bf14","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/act_ife.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.6"},{"lessThan":"4.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.302","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.247","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.197","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.159","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.117","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.59","versionType":"semver"},{"lessThanOrEqual":"6.17.*","status":"unaffected","version":"6.17.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.18","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.302","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.247","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.197","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.159","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.117","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.59","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17.9","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18","versionStartIncluding":"4.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak\n\nFix a KMSAN kernel-infoleak detected  by the syzbot .\n\n[net?] KMSAN: kernel-infoleak in __skb_datagram_iter\n\nIn tcf_ife_dump(), the variable 'opt' was partially initialized using a\ndesignatied initializer. While the padding bytes are reamined\nuninitialized. nla_put() copies the entire structure into a\nnetlink message, these uninitialized bytes leaked to userspace.\n\nInitialize the structure with memset before assigning its fields\nto ensure all members and padding are cleared prior to beign copied.\n\nThis change silences the KMSAN report and prevents potential information\nleaks from the kernel memory.\n\nThis fix has been tested and validated by syzbot. This patch closes the\nbug reported at the following syzkaller link and ensures no infoleak."}],"providerMetadata":{"dateUpdated":"2026-05-11T21:46:15.442Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/918e063304f945fb93be9bb70cacea07d0b730ea"},{"url":"https://git.kernel.org/stable/c/5e3644ef147bf7140259dfa4cace680c9b26fe8b"},{"url":"https://git.kernel.org/stable/c/37f0680887c5aeba9a433fe04b35169010568bb1"},{"url":"https://git.kernel.org/stable/c/2191662058443e0bcc28d11694293d8339af6dde"},{"url":"https://git.kernel.org/stable/c/a676a296af65d33725bdf7396803180957dbd92e"},{"url":"https://git.kernel.org/stable/c/d1dbbbe839647486c9b893e5011fe84a052962df"},{"url":"https://git.kernel.org/stable/c/c8f51dad94cbb88054e2aacc272b3ce1ed11fb1e"},{"url":"https://git.kernel.org/stable/c/ce50039be49eea9b4cd8873ca6eccded1b4a130a"}],"title":"net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-40278","datePublished":"2025-12-06T21:51:01.693Z","dateReserved":"2025-04-16T07:20:57.184Z","dateUpdated":"2026-06-02T13:00:18.583Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-12-06 22:15:55","lastModifiedDate":"2026-06-02 14:16:33","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"40278","Ordinal":"1","Title":"net: sched: act_ife: initialize struct tc_ife to fix KMSAN kerne","CVE":"CVE-2025-40278","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"40278","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak\n\nFix a KMSAN kernel-infoleak detected  by the syzbot .\n\n[net?] KMSAN: kernel-infoleak in __skb_datagram_iter\n\nIn tcf_ife_dump(), the variable 'opt' was partially initialized using a\ndesignatied initializer. While the padding bytes are reamined\nuninitialized. nla_put() copies the entire structure into a\nnetlink message, these uninitialized bytes leaked to userspace.\n\nInitialize the structure with memset before assigning its fields\nto ensure all members and padding are cleared prior to beign copied.\n\nThis change silences the KMSAN report and prevents potential information\nleaks from the kernel memory.\n\nThis fix has been tested and validated by syzbot. This patch closes the\nbug reported at the following syzkaller link and ensures no infoleak.","Type":"Description","Title":"net: sched: act_ife: initialize struct tc_ife to fix KMSAN kerne"}]}}}