CVE-2025-40019 crypto: essiv - Check ssize for decryption and in-place encryption
A missing size check in the Linux kernel's ESSIV crypto module can lead to integer overflow issues during decryption or in-place encryption, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40019?
CVE-2025-40019 is a vulnerability in Linux, published on 24 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: essiv - Check ssize for decryption and in-place encryption
Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
Which versions are affected by CVE-2025-40019?
How do I fix CVE-2025-40019?
Apply the vendor's patch.
Is CVE-2025-40019 being exploited?
There is no known exploitation of CVE-2025-40019 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as AZL-68766, BELL-CVE-2025-40019, DEBIAN-CVE-2025-40019, GHSA-jrm5-c55w-xm5w, ROOT-OS-DEBIAN-11-CVE-2025-40019, ROOT-OS-DEBIAN-12-CVE-2025-40019 and 12 more.