CVE-2025-40236: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40236 is an information disclosure vulnerability in the Linux kernel's virtio-net driver. When GSO (Generic Segmentation Offload) tunnel is negotiated, the virtio_net_hdr_tnl_from_skb() function initializes tunnel metadata but fails to zero unused rxhash fields, potentially leaking kernel memory information to another side. The vulnerability was published on December 4, 2025, and affects Linux kernel versions up to the fix commits. Patched versions include Linux 6.17.6 and 6.18. The EPSS score is approximately 0.024% (very low), and no CVSS score has been formally assigned (Feedly, EUVD).

The root cause is an uninitialized memory exposure (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the virtio-net driver's tunnel header construction path. Specifically, virtio_net_hdr_tnl_from_skb() populates tunnel metadata fields for GSO tunnel negotiation but omits zeroing the unused rxhash fields in the virtio_net_hdr structure before passing it to the other side of the virtio interface. This means stale kernel memory values in those fields may be transmitted to a guest or host VM peer. Exploitation requires that GSO tunnel offload be negotiated between the virtio-net peers. The fix involves explicitly zeroing the unused hash fields before the header is transmitted (Feedly, Kernel Patch 1, Kernel Patch 2).

The primary impact is an information disclosure: uninitialized kernel memory values from the rxhash fields may be exposed to a peer VM or host through the virtio-net interface when GSO tunnel offload is active. This could allow a malicious or compromised guest to read stale kernel memory data, potentially revealing sensitive information such as kernel addresses or other in-memory data that could assist in further attacks (e.g., bypassing KASLR). Integrity and availability are not directly affected by this vulnerability (Feedly, EUVD).

There is no known public proof-of-concept exploit for CVE-2025-40236, and it has not been observed in active exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. Exploitation is limited to environments where virtio-net with GSO tunnel negotiation is in use, such as KVM/QEMU-based virtualization setups (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in versions 6.17.6 and 6.18. Administrators should update their Linux kernel to at least version 6.17.6 or apply the upstream fix commits (b625d231c66a and b2284768c6b3). As a workaround, disabling GSO tunnel offload on virtio-net interfaces may reduce exposure in environments where patching is not immediately possible (Kernel Patch 1, Kernel Patch 2, EUVD).