LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40010: afs: Fix potential null pointer dereference in afs_put_server

In the Linux kernel, the following vulnerability has been resolved: afs: Fix potential null pointer dereference in afs_put_server afs_put_server() accessed server->debug_id before the NULL check, which could lead to a null pointer dereference. Move the debug_id assignment, ensuring we never dereference a NULL server pointer.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-40010 is a Linux kernel AFS bug where the kernel could read from a missing server object before checking it exists. The disclosed impact is a potential null pointer dereference, typically meaning a crash or denial of service risk. Public sources provide no CVSS score or confirmed exploitation.

Executive priority

Handle through normal kernel patch governance unless AFS is used on sensitive or multi-user systems. No active exploitation is cited, but kernel crashes can affect availability.

Technical view

The flaw is in afs_put_server(). It accessed server->debug_id before validating that server was not NULL. Kernel stable commits move the debug_id assignment after the NULL check. The affected data points to Linux kernel versions and related stable fixes, but the source bundle does not define attack prerequisites or reachable scenarios.

Likely exposure

Exposure appears limited to Linux systems with affected kernel builds where the AFS filesystem codepath is present and reachable. Distribution backports may change exposure, so version strings alone are insufficient.

Exploitation context

The bundle does not cite active exploitation, public exploit code, KEV listing, CVSS, or a complete threat model. Treat this as a reliability and potential denial-of-service issue until vendor advisories clarify practical reachability.

Researcher notes

Evidence is narrow: the public description only confirms a NULL dereference fixed in afs_put_server(). The affected version list is not enough to infer distribution status, exploitability, or remote reachability. Validate against exact kernel source or vendor backports.

Mitigation direction

  • Check Linux distribution advisories for CVE-2025-40010.
  • Update to a kernel containing the referenced stable fix.
  • Confirm whether your vendor backported the fix.
  • Prioritize internet-facing or multi-user Linux systems first.
  • Track kernel errata if you use AFS functionality.

Validation and detection

  • Inventory running kernel versions across Linux hosts.
  • Check vendor package changelogs for CVE-2025-40010 or the fix commits.
  • Identify systems using or loading AFS kernel functionality.
  • Review kernel logs for AFS-related crashes or oops messages.
  • Document exceptions awaiting vendor-fixed kernels.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40010 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2757a4dc184997c66ef1de32636f73b9f21aac14, 2757a4dc184997c66ef1de32636f73b9f21aac14, 2757a4dc184997c66ef1de32636f73b9f21aac14, 2757a4dc184997c66ef1de32636f73b9f21aac14, 2757a4dc184997c66ef1de32636f73b9f21aac14unaffected
LinuxLinux6.0, 0, 6.1.155, 6.6.109, 6.12.50, 6.16.10, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.