CVE-2025-40302: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40302 is a vulnerability in the Linux kernel's media: videobuf2 subsystem where the vb2_ioctl_remove_bufs() function can manipulate the internal buffer queue list while legacy fileio access mode is active, potentially overwriting internal pointers and corrupting queue state between subsequent read/write calls. It was published on December 8, 2025, and affects Linux kernel versions starting from commit a3293a85381ec9680aa2929547fbc76c5d87a1b2 up to the patched releases. Patched versions include kernel 6.12.58, 6.17.8, and 6.18 (Red Hat Advisory, Red Hat Bugzilla). The vulnerability carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory).

The root cause is improper state management (related to CWE-362, race condition / concurrent access) in the Linux kernel's videobuf2 subsystem: vb2_ioctl_remove_bufs() does not check whether legacy fileio mode is active before manipulating the internal buffer list, allowing it to overwrite pointers that the fileio path relies on across sequential read/write calls. An attacker with low-privilege local access can invoke the VIDIOC_REMOVE_BUFS ioctl on a video device while a legacy fileio operation is in progress, triggering the pointer corruption. The fix adds a guard in vb2_ioctl_remove_bufs() to reject the ioctl when fileio is active, protecting internal queue state (Red Hat Bugzilla, EUVD). Upstream patches are available at three stable kernel commits: a6a493b985bf, e819b34df0a7, and 27afd6e066cf (EUVD).

Successful exploitation could result in high confidentiality, integrity, and availability impact on the affected system, as corrupted buffer pointers in the kernel's media subsystem may lead to memory corruption, system instability, or potential privilege escalation (Red Hat Advisory). The vulnerability is locally scoped and requires low privileges, limiting its reach to systems where unprivileged users have access to video/media devices. Systems actively using the Linux kernel's media/video subsystem (e.g., those with V4L2-based capture or streaming devices) are most at risk (Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Red Hat Advisory). The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and high attack complexity, further reducing practical risk (Red Hat Advisory).

Apply the upstream kernel patches available for the affected versions: kernel 6.12.58, 6.17.8, and 6.18 include the fix (EUVD). As a workaround, restrict local user access to video/media devices (e.g., via device permissions or group membership controls) to reduce exposure on systems that cannot be immediately patched. Prioritize patching on systems actively using V4L2-based media devices or running workloads that involve legacy fileio access mode (Red Hat Advisory).