CVE-2025-40182: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40182 affects the Linux kernel's crypto subsystem, specifically related to the skcipher reqsize handling. The vulnerability was introduced when the cra_reqsize field was added to the crypto_alg struct to replace type-specific reqsize fields. While this change was initially intended for ahash and acomp frameworks, its broader application to all crypto algorithms led to potential issues (Debian Security).

The vulnerability stems from improper reqsize handling in the skcipher algorithms. The underlying functions in the algorithm framework were not updated to properly set the reqsize from cra_reqsize, which can result in memory corruptions and crashes. This issue specifically affects the crypto subsystem's skcipher implementation (Debian Security).

The vulnerability can lead to memory corruptions and system crashes when using affected skcipher algorithms in the Linux kernel's crypto subsystem (Debian Security).

The issue has been fixed in various Linux kernel versions including 5.10.223-1 for Debian bullseye, 6.1.148-1 for bookworm, and 6.12.57-1 for trixie. The fix involves adding proper set_reqsize calls in the skcipher init function to properly initialize reqsize for these algorithms in the framework (Debian Security).