Security readout for executives and security teams
Plain-English summary
A flaw in Linux Intel VT-d diagnostic code can make the kernel follow an invalid page-table pointer and crash. The supplied CVSS assessment also indicates possible confidentiality and integrity impact, although the public description specifically demonstrates a kernel fault. Exploitation requires local access and particular IOMMU, legacy-mode, and debugfs conditions.
Executive priority
Prioritize internet-facing, multi-user, hosting, and virtualization systems where untrusted local workloads may coexist with VT-d and debugfs exposure. Schedule prompt patching through normal kernel maintenance and accelerate systems meeting those conditions. Evidence does not currently justify an emergency response based on active exploitation.
Technical view
The VT-d debugfs page-table dump incorrectly used SSPTPTR in legacy mode when the translation type was neither 00b nor 01b. Because that pointer may be zero or uninitialized, walking it can cause a general-protection fault. The kernel fix avoids the walk for unsupported translation types.
Likely exposure
Potentially exposed systems run an affected Linux kernel, use Intel VT-d legacy mode, expose the relevant debugfs diagnostic interface, and permit a local user to access it. The bundle names 6.7, 6.12.53, 6.17.3, and 6.18 among affected versions, but distribution backports and exact ranges require vendor verification.
Exploitation context
The CVSS 3.1 vector is 7.3 and describes local, low-complexity exploitation requiring low privileges and no user interaction. CISA KEV status is false in the supplied bundle, and no cited source establishes active exploitation. The disclosed example shows a root process triggering a kernel fault, leaving practical low-privilege reachability insufficiently documented.
Researcher notes
The concrete failure is an invalid SSPTPTR page-table walk producing a general-protection fault. No CWE is supplied. The CVSS vector claims high confidentiality and availability impact plus low integrity impact, but the narrative only demonstrates an oops. Researchers should distinguish theoretical scored impact from reproduced behavior and clarify the apparent PR:L versus root-process discrepancy.
Mitigation direction
- Identify systems using Intel VT-d and affected kernel builds.
- Apply a vendor kernel update incorporating the cited stable fix.
- Check distribution advisories for backported fixes and package-specific status.
- Restrict unnecessary access to debugfs until affected systems are updated.
- Avoid relying solely on upstream version numbers when vendors backport patches.
Validation and detection
- Record each system's kernel package, build, and distribution revision.
- Confirm fix inclusion against vendor advisories or cited upstream commits.
- Verify whether Intel VT-d legacy mode is used on each system.
- Determine whether debugfs is mounted and accessible to non-administrators.
- After updating, confirm systems boot normally and report the expected kernel build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40155 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d8cf7b59c49f9118fa875462e18686cb6b131bb5CVE reference, Linux
- https://git.kernel.org/stable/c/df2bf759a0bdb71f13e327d7527260d09facc055CVE reference, Linux
- https://git.kernel.org/stable/c/fbe6070c73badca726e4ff7877320e6c62339917CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.