CVE-2025-40358
Published Dec 16, 2025
Modified Apr 15, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: riscv: stacktrace: Disable KASAN checks for non-current tasks Unwinding the stack of a task other than current, KASAN would report "BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460" There is a same issue on x86 and has been resolved by the commit 84936118bdf3 ("x86/unwind: Disable KASAN checks for non-current tasks") The solution could be applied to RISC-V too. This patch also can solve the issue: https://seclists.org/oss-sec/2025/q4/23 [[email protected]: clean up checkpatch issues]
Is your site exposed to CVE-2025-40358?
Run a free security scan — no signup, results in seconds.
References
Other References
https://git.kernel.org/stable/c/060ea84a484e852b52b938f234bf9b5503a6c910
https://git.kernel.org/stable/c/27379fcc15a10d3e3780fe79ba3fc7ed1ccd78e2
https://git.kernel.org/stable/c/2c8d2b53866fb229b438296526ef0fa5a990e5e5
https://git.kernel.org/stable/c/ef4d626ac59a56f8ec5cc09c1fef26f2923eec6f
https://git.kernel.org/stable/c/f34ba22989da61186f30a40b6a82e0b3337b96fc
Frequently Asked Questions
What is CVE-2025-40358? +
In the Linux kernel, the following vulnerability has been resolved:
riscv: stacktrace: Disable KASAN checks for non-current tasks
Unwinding the stack of a task other than current, KASAN would report
"BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460"
There is a same issue on x86 and has been resolved by the commit
84936118bdf3 ("x86/unwind: Disable KASAN checks for non-current tasks")
The solution could be applied to RISC-V too.
This patch also can solve the issue:
https://seclists.org/oss-sec/2025/q4/23
[[email protected]: clean up checkpatch issues]
How do I check if I'm vulnerable to CVE-2025-40358? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.