{"id":"CVE-2025-40180","title":"mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop\n\nThe cleanup loop was starting at the wrong array index, causing\nout-of-bounds access.\nStart the l…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < 47a92030422d09c2de0633d23f660a65b717f008","Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < cd0cbf2713f6e027ebba867cb7409ae345a31312","Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < ab96f08ecedd263ecaab9df8455bfb23b07fdcc2","Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < 0aead8197fc1a85b0a89646e418feb49a564b029","Linux 5.1"],"published":"2025-11-12","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:37:52.756Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40180","references":[{"url":"https://git.kernel.org/stable/c/47a92030422d09c2de0633d23f660a65b717f008"},{"url":"https://git.kernel.org/stable/c/cd0cbf2713f6e027ebba867cb7409ae345a31312"},{"url":"https://git.kernel.org/stable/c/ab96f08ecedd263ecaab9df8455bfb23b07fdcc2"},{"url":"https://git.kernel.org/stable/c/0aead8197fc1a85b0a89646e418feb49a564b029"}],"tags":["cve.org"],"epss":0.00249,"epssPercentile":0.16111,"ingestedAt":"2026-10-21T12:48:53.681Z","slug":"CVE-2025-40180","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop\n\nThe cleanup loop was starting at the wrong array index, causing\nout-of-bounds access.\nStart the loop at the correct index for zero-indexed arrays to prevent\naccessing memory beyond the allocated array bounds.\n\n## Affected\n\n- `Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < 47a92030422d09c2de0633d23f660a65b717f008`\n- `Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < cd0cbf2713f6e027ebba867cb7409ae345a31312`\n- `Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < ab96f08ecedd263ecaab9df8455bfb23b07fdcc2`\n- `Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < 0aead8197fc1a85b0a89646e418feb49a564b029`\n- `Linux 5.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}