Not yet scoredPublished Oct 24, 2025

CVE-2025-40019crypto: essiv - Check ssize for decryption and in-place encryption

Updated under an hour ago (Oct 27, 2026, 3:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from be1eb7f78aa8fbe34779c56c266ccd0364604e71 before 29294dd6f1e7acf527255fb136ffde6602c3a129; from be1eb7f78aa8fbe34779c56c266ccd0364604e71 before 71f03f8f72d9c70ffba76980e78b38c180e61589; from be1eb7f78aa8fbe34779c56c266ccd0364604e71 before df58651968f82344a0ed2afdafd20ecfc55ff548; from be1eb7f78aa8fbe34779c56c266ccd0364604e71 before 248ff2797ff52a8cbf86507f9583437443bf7685; from be1eb7f78aa8fbe34779c56c266ccd0364604e71 before f37e7860dc5e94c70b4a3e38a5809181310ea9ac; from be1eb7f78aa8fbe34779c56c266ccd0364604e71 before dc4c854a5e7453c465fa73b153eba4ef2a240abe; from be1eb7f78aa8fbe34779c56c266ccd0364604e71 before da7afb01ba05577ba3629f7f4824205550644986; from be1eb7f78aa8fbe34779c56c266ccd0364604e71 before 6bb73db6948c2de23e407fe1b7ef94bf02b7529f	CNA record

References

References

https://git.kernel.org/stable/c/29294dd6f1e7acf527255fb136ffde6602c3a129
https://git.kernel.org/stable/c/71f03f8f72d9c70ffba76980e78b38c180e61589
https://git.kernel.org/stable/c/df58651968f82344a0ed2afdafd20ecfc55ff548
https://git.kernel.org/stable/c/248ff2797ff52a8cbf86507f9583437443bf7685
https://git.kernel.org/stable/c/f37e7860dc5e94c70b4a3e38a5809181310ea9ac
https://git.kernel.org/stable/c/dc4c854a5e7453c465fa73b153eba4ef2a240abe
https://git.kernel.org/stable/c/da7afb01ba05577ba3629f7f4824205550644986
https://git.kernel.org/stable/c/6bb73db6948c2de23e407fe1b7ef94bf02b7529f

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.