CVE-2025-40331 is a vulnerability in the Linux kernel's SCTP subsystem where a TOCTOU condition allows an out-of-bounds write. Specifically, during the sctp_diag_dump() call chain (sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()), the code does not hold the socket lock and fails to ensure that the address list has not grown between the time the buffer is allocated (time-of-check) and when it is written to (time-of-use). This can cause memory corruption due to writing beyond allocated bounds. The vulnerability has been resolved in the Linux kernel.

Successful exploitation can lead to out-of-bounds memory writes, resulting in potential system instability, denial of service, or privilege escalation due to memory corruption. The CVSS vector indicates local attack vector with low complexity, requiring low privileges and no user interaction, with high confidentiality, integrity, and availability impact.

A fix for this vulnerability is available in the Linux kernel. Users and administrators should apply the official Linux kernel updates that address CVE-2025-40331 to remediate this issue. Patch status is not explicitly confirmed in the provided data, so verify with the Linux kernel vendor advisory for the exact fixed versions and update accordingly.