CVE-2025-40292

What it actually does

The vulnerability allows a malicious hypervisor to announce an oversized buffer length for big packets in virtio-net when guest GSO is off, bypassing the receive length check against vi->big_packets_num_skbfrags and causing a NULL page pointer dereference in the skb fragment allocation loop.

Why it matters to the business

In virtualized Linux environments relying on virtio networking, this can result in guest kernel crashes and denial of service triggered by a compromised host, interrupting VM availability. The low EPSS and lack of known exploitation reduce urgency, but widespread Linux kernel usage in clouds and data centers means broad patching is needed.

How an attack unfolds

An attacker with control over the host vhost_net driver alters get_rx_bufs to supply an incorrect buffer length exceeding the guest's allocated fragments; when the guest receives the packet in the virtio-net path the unadapted check fails, leading to the NULL dereference.

How to fix it

Upgrade the Linux kernel to a version containing commit 82f9028e83944a9eee5229cbc6fee9be1de8a62d or any later stable release that applies the updated length check for big packets.

How to confirm the fix worked

Confirm the running kernel source or binary includes the corrected received-length validation that references vi->big_packets_num_skbfrags; test by attempting oversized buffer announcements in a controlled virtio setup and verifying no dereference occurs.

Typical attack path

1. Gain control of the hypervisor or modify the vhost_net driver on the host
2. Configure virtio-net to announce a malicious buffer length larger than the guest's big_packets_num_skbfrags allocation
3. Trigger big-packet reception in the guest with GSO disabled
4. Induce the NULL pointer dereference and resulting kernel panic

How to detect it

Search guest kernel logs for NULL pointer dereference panics or oopses originating from the virtio_net receive path during big-packet handling; correlate with host-side anomalies in vhost_net buffer announcements.

What your security team should do

• Apply the kernel patch containing commit 82f9028e83944a9eee5229cbc6fee9be1de8a62d to all affected virtio-net guests without delay
• Audit virtualization hosts for unauthorized modifications to vhost_net or similar drivers
• Enable kernel crash logging and monitoring for virtio_net receive-path oopses as a compensating control