CVE-2025-40260: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40260 is a null/error-pointer dereference vulnerability in the Linux kernel's sched_ext (extensible scheduler) subsystem that can cause a kernel crash. The flaw exists in scx_enable() and scx_alloc_and_add_sched(), where kthread_run_worker() returning an ERR_PTR() on failure is incorrectly treated as a NULL pointer, leading to a crash when the error is dereferenced. It was published on December 4, 2025, and affects Linux kernel versions from commit bff3b5aec1b7 up to (but not including) the fix commits, with patches landing in kernel 6.17.10 and 6.18 (EUVD). The CVSS base score has not been formally assigned; Feedly estimates the severity as Medium with an EPSS score of 0.000240 (Feedly).

The root cause is improper error handling (CWE-476: NULL Pointer Dereference / error pointer dereference) in the sched_ext kernel subsystem. When kthread_run_worker() fails — for example, due to a SIGQUIT signal interrupting the sched_ext selftests runner — it returns an ERR_PTR() value rather than NULL. The function scx_alloc_and_add_sched() only checked for a NULL return, so the ERR_PTR() was passed back to scx_enable(), which subsequently dereferenced it, triggering a kernel panic. The fix propagates the error via PTR_ERR() into the return value so that scx_enable() correctly jumps to its existing error-handling path (EUVD). The crash was reproducible via the BPF bpf_struct_ops_link_create syscall path when a helper kthread could not be created (Feedly).

Successful triggering of this vulnerability causes a kernel crash (panic), resulting in a denial of service for the affected system. Because the crash occurs in kernel space during scheduler initialization, it can bring down the entire host, affecting all workloads running on it. There is no evidence of confidentiality or integrity impact beyond the availability loss caused by the crash.

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-40260. The vulnerability was discovered during internal kernel testing (sched_ext selftests) and requires the ability to invoke BPF bpf_struct_ops_link_create with a sched_ext scheduler, which typically requires elevated privileges (CAP_BPF or root). The EPSS score is 0.000240, indicating very low probability of exploitation in the near term, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

The fix is included in Linux kernel stable releases 6.17.10 and 6.18, corresponding to upstream commits 625e173e2a59 and 7b6216baae75 (EUVD). Ubuntu has issued security notices USN-8094-1 through USN-8094-5 and USN-8152-1 addressing this and related kernel vulnerabilities (Ubuntu USN-8094-1, Ubuntu USN-8152-1). Users should update to a patched kernel version as soon as possible; no configuration-based workaround is available other than avoiding use of the sched_ext BPF scheduler interface on unpatched systems.