CVE-2025-40204 sctp: Fix MAC comparison to be constant-time
An attacker can exploit timing side-channels in SCTP MAC comparisons to potentially recover sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40204?
CVE-2025-40204 is a high-severity vulnerability in Linux, published on 12 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sctp: Fix MAC comparison to be constant-time
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
Which versions are affected by CVE-2025-40204?
How do I fix CVE-2025-40204?
Apply the vendor's patch.
Is CVE-2025-40204 being exploited?
There is no known exploitation of CVE-2025-40204 in the wild and no public exploit code.
Sources
Also known as AZL-70112, BELL-CVE-2025-40204, DEBIAN-CVE-2025-40204, GHSA-4xv3-7wp7-qjp7, ROOT-OS-DEBIAN-11-CVE-2025-40204, ROOT-OS-DEBIAN-13-CVE-2025-40204 and 2 more.