Strix
26.1K

CVE-2025-40262

HIGHCVSS 7.8/10EPSS 0.18%

Last modified

CVE-2025-40262 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.18%

7.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 768062fd1284529212daffd360314e9aa93abb62, < 3e96803b169dc948847f0fc2bae729a80914eb7b; >= 768062fd1284529212daffd360314e9aa93abb62, < 4ce5218b101205b3425099fe3df88a61b58f9cc2; >= 768062fd1284529212daffd360314e9aa93abb62, < a155292c3ce722036014da5477ee0e4c87b5e6b3; >= 768062fd1284529212daffd360314e9aa93abb62, < ca9a08de9b294422376f47ade323d69590dbc6f2; >= 768062fd1284529212daffd360314e9aa93abb62, < 56881294915a6e866d31a46f9bcb5e19167cfbaa; >= 768062fd1284529212daffd360314e9aa93abb62, < 6524a15d33951b18ac408ebbcb9c16e14e21c336; >= 768062fd1284529212daffd360314e9aa93abb62, < d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4
LinuxLinux5.8

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2025-40262?
In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &.
How severe is CVE-2025-40262?
CVE-2025-40262 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2025-40262?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-40262?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST