Security readout for executives and security teams
Plain-English summary
The Linux kernel compared SCTP authentication codes in a way that could leak information through response timing. A remote attacker may be able to use repeated measurements to undermine message authentication, potentially affecting confidentiality, integrity, and availability. Exploitation requires difficult timing conditions, but the supplied CVSS score is 8.1.
Executive priority
Treat as a high-priority targeted remediation, especially where SCTP is externally reachable or supports sensitive services. First establish actual SCTP use and vendor backport status. This is serious but not evidence of an ongoing emergency because exploitation is technically difficult and no active exploitation is documented.
Technical view
The SCTP implementation used a non-constant-time MAC comparison. Differences in comparison duration can disclose partial information about a valid authentication code. The kernel fix replaces this behavior with the appropriate constant-time comparison helper. The source bundle rates attack complexity high and requires no privileges or user interaction.
Likely exposure
Exposure is most relevant to systems running an affected Linux kernel and processing SCTP traffic from untrusted networks. Risk depends on SCTP use, reachability, kernel build, and whether the distribution has backported a referenced fix. The supplied version data is ambiguous, so version numbers alone may not establish vulnerability.
Exploitation context
The CVSS vector describes remote, unauthenticated exploitation with high attack complexity and potentially high impact. The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, public exploit code, or demonstrated practical attacks.
Researcher notes
The core weakness is timing-variable verification of SCTP MACs. Reviewers should map the referenced stable commits to exact downstream kernel packages because the supplied affected-version entries mix release versions and commit identifiers. The bundle does not identify a CWE, attack measurements, proof of concept, or confirmed exploitability in specific deployments.
Mitigation direction
- Identify Linux systems that use SCTP or accept SCTP traffic from untrusted networks.
- Check distribution or kernel vendor guidance for affected builds and available security updates.
- Install a vendor-supported kernel containing the applicable referenced constant-time comparison fix.
- If immediate updating is impossible, apply only vendor-recommended SCTP exposure controls.
Validation and detection
- Record each system's running kernel build, distribution package revision, and SCTP usage.
- Verify package backport status against vendor advisories or the referenced stable kernel commits.
- Confirm the remediated kernel is running after update and restart procedures.
- Reassess whether untrusted SCTP traffic can reach systems awaiting remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40204 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b93fa8dc521d00d2d44bf034fb90e0d79b036617CVE reference, Linux
- https://git.kernel.org/stable/c/0e8b8c326c2a6de4d837b1bb034ea704f4690d77CVE reference, Linux
- https://git.kernel.org/stable/c/1cd60e0d0fb8f0e62ec4499138afce6342dc9d4cCVE reference, Linux
- https://git.kernel.org/stable/c/9c05d44ec24126fc283835b68f82dba3ae985209CVE reference, Linux
- https://git.kernel.org/stable/c/ed3044b9c810c5c24eb2830053fbfe5fd134c5d4CVE reference, Linux
- https://git.kernel.org/stable/c/8019b3699289fce3f10b63f98601db97b8d105b0CVE reference, Linux
- https://git.kernel.org/stable/c/0b32ff285ff6f6f1ac1d9495787ccce8837d6405CVE reference, Linux
- https://git.kernel.org/stable/c/dd91c79e4f58fbe2898dac84858033700e0e99fbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.