What’s Vulnerable › Vulnerabilities

CVE-2025-40236: virtio-net: zero unused hash fields

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-04 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: virtio-net: zero unused hash fields When GSO tunnel is negotiated virtio_net_hdr_tnl_from_skb() tries to initialize the tunnel metadata but forget to zero unused rxhash fields. This may leak information to another side. Fixing this by zeroing the unused hash fields.

Affected products

• Linux kernel: 6.17 — fixed in 6.18

How to fix

Upgrade to a fixed version: Linux kernel 6.18. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/b2284768c6b32aa224ca7d0ef0741beb434f03aa
• https://git.kernel.org/stable/c/b625d231c66a6041e98817ffc944bf6e4c45b2e3

Get alerted when CVE-2025-40236 or the next vulnerability affects your stack