CVE-2025-40358: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40358 is a vulnerability in the Linux kernel's RISC-V stack unwinding subsystem where KASAN (Kernel Address Sanitizer) checks are not disabled when unwinding the stack of a task other than the currently running task. This causes KASAN to incorrectly report out-of-bounds access errors (BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460) during legitimate stack trace operations. The issue affects Linux kernel versions from commit 5d8544e2d007 onward, and is fixed in stable releases 6.6.117, 6.12.58, 6.17.8, and 6.18. The CVSS base score is 0.0 (no severity rating assigned at time of publication) (Feedly, ENISA EUVD).

The root cause is that the RISC-V walk_stackframe() function does not disable KASAN shadow memory checks when unwinding the stack of a non-current task, leading to false-positive out-of-bounds reports (CWE-125: Out-of-bounds Read). When the kernel attempts to walk the stack frames of a sleeping or stopped task, KASAN's memory access validation incorrectly flags the access as out-of-bounds because the shadow memory region for that task's stack is not the active one. An analogous issue was previously resolved on x86 via commit 84936118bdf3 ("x86/unwind: Disable KASAN checks for non-current tasks"), and the same fix pattern was applied to RISC-V. The fix involves using KASAN-unsafe accessors when iterating stack frames of non-current tasks (Feedly).

The primary impact of this vulnerability is kernel stability and diagnostic reliability on RISC-V systems: KASAN incorrectly reports out-of-bounds bugs during stack unwinding of non-current tasks, which can cause kernel panics or misleading bug reports in KASAN-enabled debug kernels. This does not directly enable privilege escalation, data exfiltration, or remote code execution, but can disrupt kernel debugging workflows and potentially cause denial-of-service conditions in environments running KASAN-instrumented kernels. Production kernels without KASAN enabled are not affected by the false-positive reports, limiting the practical impact to development and testing environments (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-40358. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Its impact is limited to KASAN-enabled kernel builds on RISC-V architecture, significantly narrowing the attack surface (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Users should update to the following patched versions: 6.6.117, 6.12.58, 6.17.8, or 6.18 (mainline). The upstream fix commits are available at the kernel stable repository for each affected branch. As a workaround, disabling KASAN (CONFIG_KASAN=n) in kernel builds eliminates the false-positive reports, though this removes memory safety instrumentation. Distributions such as Debian have issued advisories (DSA-6243-1, DLA-4561-1) incorporating these fixes (Feedly, Linux Security Debian, Linux Security LTS).

The vulnerability was referenced in an oss-security mailing list post (https://seclists.org/oss-sec/2025/q4/23), which the kernel patch explicitly cites as a related issue it resolves. No significant broader media coverage or notable researcher commentary beyond the kernel community has been identified (Feedly).