CVE-2025-40019: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40019 is a vulnerability discovered in the Linux kernel's crypto subsystem, specifically in the ESSIV (Encrypted Salt-Sector Initialization Vector) implementation. The vulnerability was disclosed on October 24, 2025, and affects the ssize check functionality in essivaeadcrypt for decryption and in-place encryption operations (NVD).

The vulnerability relates to improper validation of ssize parameters in the ESSIV crypto implementation. The issue specifically involves the timing of ssize checks in the essivaeadcrypt function, which needed to be moved to the start of the process to ensure proper validation for both decryption and in-place encryption operations. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 with attack vector being Local (AV:L), attack complexity Low (AC:L), and requiring low privileges (PR:L) (Red Hat).

The vulnerability primarily affects the availability aspect of the system, with no direct impact on confidentiality or integrity. According to the CVSS metrics, it can lead to high availability impact (A:H) if successfully exploited (Red Hat).

The vulnerability has been addressed in the Linux kernel, with fixes being rolled out to various distributions. Red Hat has marked this for deferred fixes in RHEL 8, 9, and 10, while RHEL 6 and 7 are not affected. Debian has identified multiple affected versions including bullseye, bookworm, trixie, and sid, with security updates pending (Debian Tracker, Red Hat).