CVE-2025-40264: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40264 is a NULL pointer dereference vulnerability in the Linux kernel's be2net network driver. The flaw exists in the be_insert_vlan_in_pkt() function, which is called with a NULL wrb_params argument at the be_send_pkt_to_bmc() call site during OS2BMC (OS-to-Baseboard Management Controller) packet processing. This can cause a kernel crash when handling specific network packets. The vulnerability was published on December 4, 2025, and affects the Linux kernel starting from the commit that introduced the OS2BMC path. It carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the be2net Ethernet driver. Specifically, be_send_pkt_to_bmc() calls be_insert_vlan_in_pkt() without passing the wrb_params structure (passing NULL instead), while the function may dereference this pointer when applying a workaround for a specific IPv6 packet type — as originally described in commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet"). The fix requires propagating wrb_params from be_xmit() through to be_send_pkt_to_bmc() so that be_insert_vlan_in_pkt() receives a valid pointer. The attack vector is local, requiring low privileges, and no special user interaction is needed (Microsoft MSRC, Feedly).

Successful exploitation of this vulnerability allows a local attacker with low-level privileges to trigger a kernel NULL pointer dereference, resulting in a system crash and denial of service (DoS). There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems using Broadcom (Emulex) be2net network adapters with OS2BMC functionality enabled are at risk of complete system unavailability during exploitation (Microsoft MSRC, Feedly).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Patches have been released for multiple Linux kernel stable branches: versions 5.4.302, 6.6.118, 6.12.60, 6.17.10, and 6.18 include the fix. Microsoft has also released updates for Azure Linux 3 kernel packages (azl3_kernel_6.6.112.1-2 and azl3_kernel_6.6.117.1-1). Downstream distributions including Ubuntu (USN-8096-1/2/3/5, USN-8094-2/3/4/5, USN-8152-1), Debian (DLA-4436-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2025-096), Oracle Linux, and SUSE have also issued kernel updates. Administrators should apply the relevant kernel update for their distribution as the primary remediation; as a secondary measure, restricting local user access on systems with be2net adapters can reduce exposure (Microsoft MSRC, Ubuntu USN-8096-1, Debian LTS).