Security readout for executives and security teams
Plain-English summary
A Linux kernel arithmetic overflow can occur when Arm Statistical Profiling Extension performance tracing uses an AUX buffer of at least 2 GiB. Successful abuse requires local, low-privileged access according to the supplied CVSS assessment. The source description does not establish the exact resulting failure mode, although the supplied rating indicates potentially severe confidentiality, integrity, and availability impact.
Executive priority
Treat this as a high-priority patching issue for multi-user or otherwise untrusted Arm Linux environments exposing performance monitoring. Prioritize internet-facing workloads only if they also permit local code execution or user access; this is not described as remotely exploitable. Confirm vendor-specific affected versions before broad emergency action.
Technical view
In the Arm SPE perf driver, PERF_IDX2OFF() could perform an overflowing calculation because nr_pages was not first widened to unsigned long. Large AUX buffers trigger the vulnerable condition. The kernel fix casts nr_pages before the offset calculation. The supplied summary does not document demonstrated memory corruption, privilege escalation, or another specific outcome.
Likely exposure
Exposure is most likely on Arm Linux systems supporting or using Arm SPE where a local low-privileged user can access performance monitoring and request a large AUX buffer. Systems without Arm SPE or without relevant local perf access are less likely exposed. The summarized version data is ambiguous, so exact affected and fixed package boundaries require vendor confirmation.
Exploitation context
The supplied CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The bundle marks the CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. It also does not show that practical exploitation has been demonstrated beyond triggering the overflow condition.
Researcher notes
The source bundle identifies the overflow threshold and corrective cast but provides little evidence about exploitability or the resulting primitive. Its version presentation includes duplicates and unusual entries, making precise range interpretation unreliable. Researchers should distinguish a reachable arithmetic overflow from demonstrated security impact and use the branch-specific stable commits when evaluating backports.
Mitigation direction
- Install a vendor-supported kernel containing the applicable cited stable fix or confirmed backport.
- Consult the Linux distributor's advisory for exact affected package and fixed-build boundaries.
- Until patched, restrict untrusted local access to performance-monitoring facilities where operationally feasible.
- Prioritize Arm systems that expose Arm SPE tracing to non-administrative users.
Validation and detection
- Inventory Arm Linux hosts, running kernel builds, and Arm SPE availability.
- Compare each kernel package against distributor advisories and documented backported fixes.
- Verify whether non-administrative users can access the relevant performance-monitoring interface.
- Confirm the installed kernel includes the appropriate stable fix for its maintained branch.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40081 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/656e9a5d69acdd1b20462f4a33378b90ddcb9626CVE reference, Linux
- https://git.kernel.org/stable/c/9c045d4501f7f70724a3bbb561f4f22d292bbfe6CVE reference, Linux
- https://git.kernel.org/stable/c/5d01f2b81568289443d22f1e13a363f829de6343CVE reference, Linux
- https://git.kernel.org/stable/c/7500384d3c9587593d75ded3b006835e7aa73ef8CVE reference, Linux
- https://git.kernel.org/stable/c/379cae2cb982f571cda9493ac573ab71125fd299CVE reference, Linux
- https://git.kernel.org/stable/c/1a19ba8e1f4ff24ece8ca69b79df8442c431db90CVE reference, Linux
- https://git.kernel.org/stable/c/e516cfd19b0f4c774a57b17fb43a7f41991f0735CVE reference, Linux
- https://git.kernel.org/stable/c/a29fea30dd93da16652930162b177941abd8c75eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.