{
  "cveId": "CVE-2025-40072",
  "url": "https://patchblox.com/security/cve/CVE-2025-40072",
  "summary": "CVE-2025-40072 is fixed in linux on 1 platform by DEBIAN-CVE-2025-40072 (version 6.17.6-1), released October 28, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  fanotify: Validate the return value of mnt_ns_fr...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing  The function do_fanotify_mark() does not validate if mnt_ns_from_dentry() returns NULL before dereferencing mntns-\u003Euser_ns. This causes a NULL pointer dereference in do_fanotify_mark() if the path is not a mount namespace object.  Fix this by checking mnt_ns_from_dentry()\u0027s return value before dereferencing it.  Before the patch  $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd: 3 fanotify_mark: Operation not permitted $ unshare -Urm Fanotify fd: 3 Killed  int main(void){     int ffd;     ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);     if(ffd \u003C 0){         perror(\u0022fanotify_init\u0022);         exit(EXIT_FAILURE);     }      printf(\u0022Fanotify fd: %d\\n\u0022,ffd);      if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS, FAN_MNT_ATTACH, AT_FDCWD, \u0022A\u0022) \u003C 0){         perror(\u0022fanotify_mark\u0022);         exit(EXIT_FAILURE);     }  return 0; }  After the patch  $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd: 3 fanotify_mark: Operation not permitted $ unshare -Urm Fanotify fd: 3 fanotify_mark: Invalid argument  [   25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038 [   25.695006] #PF: supervisor read access in kernel mode [   25.695012] #PF: error_code(0x0000) - not-present page [   25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0 [   25.695025] Oops: Oops: 0000 [#1] SMP NOPTI [   25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not tainted 6.17.0-rc4 #1 PREEMPT(lazy) [   25.695040] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [   25.695049] RIP: 0010:do_fanotify_mark\u002B0x817/0x950 [   25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54 24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b 5c 24 10 \u003C48\u003E 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28 85 c9 [   25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203 [   25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220 [   25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180 [   25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000 [   25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7 [   25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0 [   25.695154] FS:  00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000) knlGS:0000000000000000 [   25.695162] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [   25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0 [   25.695201] Call Trace: [   25.695209]  \u003CTASK\u003E [   25.695215]  __x64_sys_fanotify_mark\u002B0x1f/0x30 [   25.695222]  do_syscall_64\u002B0x82/0x2c0 ...",
  "published": "2025-10-28T12:15:41Z",
  "severity": "",
  "epss": 0.00184,
  "epssPercentile": 0.0808,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.17.6-1",
      "fix": "DEBIAN-CVE-2025-40072",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40072",
      "released": "2025-10-28T12:15:41Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}