Linux Kernel USB Network Driver Vulnerability Impacting Processor ID Handling

CVE-2025-40164

What is CVE-2025-40164?

A vulnerability in the Linux kernel's usbnet driver has been identified, which arises from incorrect use of the smp_processor_id() function in preemptible code. This can lead to undefined behavior during the execution of network-related processes, particularly affecting the usbnet_skb_return function. The issue, traced back to specific versions of the Linux kernel, has been addressed by implementing appropriate local_bh_disable/enable() protections within the usbnet_resume_rx function to prevent adverse effects in a softirq or interrupt context. Users are encouraged to update to the patched version to maintain system integrity.

References