High 7.8Published Nov 12, 2025

CVE-2025-40202ipmi: Rework user message limit handling

Updated under an hour ago (Oct 26, 2026, 6:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all done to handle more in the receive message allocation routine, so all refcouting and user message limit counts are done in that routine. It's a lot cleaner and safer.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 before f63723ca7d7623f9dae1990973cd158671f03c56; from 8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 before 348121b29594d42d1635648fd3ed31dfa25351d5; from 8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 before 53d6e403affbf6df2c859a0ea00ccfc1e72090ca; 8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 builds before 0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5; from 8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82 before b52da4054ee0bf9ecb44996f2c83236ff50b3812	CNA record

References

References

https://git.kernel.org/stable/c/f63723ca7d7623f9dae1990973cd158671f03c56
https://git.kernel.org/stable/c/348121b29594d42d1635648fd3ed31dfa25351d5
https://git.kernel.org/stable/c/53d6e403affbf6df2c859a0ea00ccfc1e72090ca
https://git.kernel.org/stable/c/0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5
https://git.kernel.org/stable/c/b52da4054ee0bf9ecb44996f2c83236ff50b3812

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.