CVE-2025-40253: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40253 is a double-free vulnerability in the Linux kernel's s390/ctcm network driver. The flaw exists in the memory management interaction between the mpc_rcvd_sweep_req() and ctcmpc_unpack_skb() functions, where the mpcginfo structure is freed twice — once inside mpc_rcvd_sweep_req() and again in ctcmpc_unpack_skb() — potentially leading to memory corruption. It was published on December 4, 2025, and affects Linux kernel versions from 5.18 through multiple stable branches prior to patched releases. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is a double-free memory error (CWE-415) in the s390/ctcm driver's MPC (Multi-Path Channel) packet handling path. When ctcmpc_unpack_skb() conditionally calls mpc_rcvd_sweep_req(mpcginfo), that function frees the mpcginfo pointer; however, ctcmpc_unpack_skb() subsequently calls kfree() on the same pointer unconditionally, resulting in a double-free. The bug was detected by the clang static analyzer and requires local, low-privileged access to trigger via the ctcm network subsystem, which is specific to IBM s390 (mainframe) hardware. The fix removes the redundant kfree() call from mpc_rcvd_sweep_req() (Feedly).

Successful exploitation could cause kernel memory corruption, potentially leading to a system crash or denial of service. The vulnerability has a high availability impact with no confidentiality or integrity impact, meaning an attacker cannot directly read or modify data but can destabilize or crash the affected system. The scope is limited to s390 (IBM mainframe) systems running the ctcm network driver, restricting the affected population to specialized enterprise environments (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges on an s390 system running the ctcm driver, significantly limiting the attack surface (Feedly).

Patches have been applied to multiple Linux kernel stable branches, including versions 5.4.302, 6.6.118, 6.12.60, 6.17.10, and 6.18. Downstream distributions including Ubuntu (USN-8096-x, USN-8094-x, USN-8152-1), Debian (DLA-4436-1), SUSE, and openSUSE have also released updated kernel packages. The recommended remediation is to update to the latest patched kernel version for your distribution. As an additional measure, restricting local user access on s390 systems running the ctcm driver can reduce exposure (Feedly, Microsoft MSRC).