CVE-2025-40292

A null pointer dereference was found in the virtio-net driver in the Linux kernel. When receiving big packets, the length validation does not account for the MTU-based buffer sizing changes. A malicious host can announce incorrect buffer lengths, causing the driver to access NULL page pointers when processing oversized packets.

This requires a malicious or compromised hypervisor host to exploit. Guest VMs running on trusted hypervisors are not at significant risk. The vulnerability allows host-to-guest attacks in virtualized environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.