P4Verified

CVE-2025-40261: Linux 5.11; +4 more affected products

CVE-2025-40261 affects azl3 kernel 6.6.112.1-2 on Azure Linux 3.0. CVSS 3.1 base score 9.8 (CRITICAL, Source advisory). EPSS 0.00564 (percentile 0.45503), scored 14-Oct-2026.

Affected technology

Linux · f1cd8c40936ff2b560e1f35159dd6a4602b558e5 to before 3f48cd7f35da07fc067cef926bb7f6f4735de37b, 19fce0470f05031e6af36e49ce222d0f0050d432 to before a9b1315ed428239612601e9e188329e7cefa32fd, 19fce0470f05031e6af36e49ce222d0f0050d432 to before 9610a2c162ef729a3988213a4604376e492f6f44, 19fce0470f05031e6af36e49ce222d0f0050d432 to before 33f64600a12055219bda38b55320c62cdeda9167, 19fce0470f05031e6af36e49ce222d0f0050d432 to before 48ae433c6cc6985f647b1b37d8bb002972cf9bdb, 19fce0470f05031e6af36e49ce222d0f0050d432 to before fbd5741a556eaaa63d0908132ca79d335b58b1cd, 19fce0470f05031e6af36e49ce222d0f0050d432 to before 0a2c5495b6d1ecb0fa18ef6631450f391a888256, 5.10.9 to before 5.10.253
Linux

Linux · 5.11
Linux

RUGGEDCOM RST2428P · 0 to before V4.0
Siemens

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.5 to before *
Siemens

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.7 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.5 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.7 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.5 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.7 to before *
Siemens

Component: Not specified by the source
File: drivers/nvme/host/fc.c

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 15-Oct-2026 09:20 UTC

Product: azl3 kernel 6.6.112.1-2 on Azure Linux 3.0
CCR priority: 39.3 /100 (P4)
CVSS 3.1: 9.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · Source advisory
EPSS: 0.00564 · percentile 0.45503 · 2026-10-14
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-15 09:24:28.011626+00:00 UTC
GitHub Advisory Database · Source record · observed 2026-10-15 10:43:56.988652+00:00 UTC
Microsoft MSRC Security Update Guide (CVRF) · Source record · observed 2026-10-04 07:08:49.022374+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-15 09:18:22.406219+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-40261.html