CVE-2025-40022 - CVE House
Back to Database
Status published Unknown CVE-2025-40022

crypto: af_alg - Fix incorrect boolean values in af_alg_ctx

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of type u32. However, some assignments to these fields, specifically 'more' and 'merge', assign values greater than 1. These relied on C's implicit conversion to bool, such that zero becomes false and nonzero becomes true. With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken instead, resulting in 0 being assigned in some cases when 1 was intended. Fix this by restoring the bool type.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-40022

Credits & Attribution

No credits recorded in the NVD database.

Affected Vendor

Affected Software

Linux
Vulnerable Versions:
0f28c4adbc4a97437874c9b669fd7958a8c6d6ce, e4c1ec11132ec466f7362a95f36a506ce4dc08c9, 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8, 7c4491b5644e3a3708f3dbd7591be0a570135b84, 9aee87da5572b3a14075f501752e209801160d3d, 45bcf60fe49b37daab1acee57b27211ad1574042, 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285, 6.1.154, 6.6.108, 6.12.49, 6.16.9

Timeline

Official Publish: October 24th, 2025
Last Modified: July 14th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.