CVE-2025-40187: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40187 was disclosed on November 12, 2025, affecting the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. The vulnerability involves a null pointer dereference in the sctp_disposition sctp_sf_do_5_1D_ce() function (NVD, Ubuntu).

The vulnerability occurs when specific conditions are met in the SCTP implementation: if new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero. This zero value will be dereferenced in the sctp_ulpevent_free() function, leading to a null pointer dereference (NVD).

The vulnerability affects multiple versions of the Linux kernel and various Ubuntu distributions including 25.10 (questing), 25.04 (plucky), 24.04 LTS (noble), 22.04 LTS (jammy), and 20.04 LTS (focal). Several kernel variants including linux-azure, linux-gcp, and linux-aws are also affected (Ubuntu).

Ubuntu has assigned this vulnerability a 'Medium' priority rating and is actively tracking its status across different kernel versions and distributions. Various kernel packages have been marked as vulnerable and require updates, while some older versions are noted as not affected or have been superseded by newer kernel versions (Ubuntu).