---
id: CVE-2025-40180
title: 'mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop

  The cleanup loop was starting at the wrong array index, causing
  out-of-bounds access.
  Start the l…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 <
    47a92030422d09c2de0633d23f660a65b717f008
  - >-
    Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 <
    cd0cbf2713f6e027ebba867cb7409ae345a31312
  - >-
    Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 <
    ab96f08ecedd263ecaab9df8455bfb23b07fdcc2
  - >-
    Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 <
    0aead8197fc1a85b0a89646e418feb49a564b029
  - Linux 5.1
published: '2025-11-12'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:37:52.756Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40180'
references:
  - url: 'https://git.kernel.org/stable/c/47a92030422d09c2de0633d23f660a65b717f008'
  - url: 'https://git.kernel.org/stable/c/cd0cbf2713f6e027ebba867cb7409ae345a31312'
  - url: 'https://git.kernel.org/stable/c/ab96f08ecedd263ecaab9df8455bfb23b07fdcc2'
  - url: 'https://git.kernel.org/stable/c/0aead8197fc1a85b0a89646e418feb49a564b029'
tags:
  - cve.org
epss: 0.00249
epssPercentile: 0.16111
ingestedAt: '2026-10-21T12:48:53.681Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop

The cleanup loop was starting at the wrong array index, causing
out-of-bounds access.
Start the loop at the correct index for zero-indexed arrays to prevent
accessing memory beyond the allocated array bounds.

## Affected

- `Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < 47a92030422d09c2de0633d23f660a65b717f008`
- `Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < cd0cbf2713f6e027ebba867cb7409ae345a31312`
- `Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < ab96f08ecedd263ecaab9df8455bfb23b07fdcc2`
- `Linux >= 4981b82ba2ff87df6a711fcd7a233c615df5fc79 < 0aead8197fc1a85b0a89646e418feb49a564b029`
- `Linux 5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.