CVE-2025-40253: Linux

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again. Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'. Bug detected by the clang static analyzer.

Affected products

• Linux Linux: from 5.4.195, before 5.4.302 (fixed in 5.4.302); from 5.10.117, before 5.10.247 (fixed in 5.10.247); from 5.15.41, before 5.15.197 (fixed in 5.15.197); from 4.9.315, before 4.10 (fixed in 4.10); from 4.14.280, before 4.15 (fixed in 4.15); from 4.19.244, before 4.20 (fixed in 4.20); …

Published 2025-12-04. Last modified 2026-07-30.