Shift-Out-Of-Bounds Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-40020: In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 (which is the case fo... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system, including process management, memory management, and device control. The kernel is a critical piece of software that is widely used across various distributions, including Debian. This vulnerability affects multiple versions of the Linux package across Debian releases 11 to 14, highlighting its significance in maintaining system integrity and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the CAN (Controller Area Network) subsystem, specifically related to the peak_usb driver. This issue arises from the improper use of a 64-bit constant when performing bit shifts, which can lead to shift-out-of-bounds errors. Such vulnerabilities can potentially allow an attacker to exploit the system, leading to unauthorized access or system crashes. The vulnerability is tracked under CVE-2025-40020 and has been resolved in the patched version 6.16.10-1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The identified shift-out-of-bounds vulnerability in the Linux kernel poses a significant risk to systems running affected versions of the package. It is crucial to update to the patched version 6.16.10-1 to mitigate potential security threats. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-40020 is a vulnerability identified in the Linux kernel related to the CAN subsystem, which can lead to shift-out-of-bounds errors.
Exploitation of this vulnerability could allow attackers to gain unauthorized access or cause system instability.
Yes, Debian versions 11, 12, 13, and 14 are affected by this vulnerability.
You can check your system's Linux package version and compare it with the patched version. Additionally, you can use tools like Vulert to monitor for vulnerabilities.
Vulert is a service that monitors and alerts for open-source vulnerabilities in your software using a manifest file. You can check if your application is affected by this vulnerability using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
