Linux Kernel CVE-2025-40018

In the Linux kernel, the following vulnerability has been resolved:

ipvs: Defer ip_vs_ftp unregister during netns cleanup

On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free.

Fix this by introducing a global exiting_module flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.

The Linux kernel IPVS subsystem (net/netfilter/ipvs/ip_vs_ftp.c and the pernet cleanup path) is affected on builds with IPVS and the FTP application helper enabled. No explicit version range or CPE was supplied in the input; the eight git.kernel.org stable references (commits 134121bfd99a, 1d79471414d7, 421b1ae1574d, 53717f8a4347, 8a6ecab3847c, 8cbe2a21d857, a343811ef138, dc1a481359a7) indicate the fix was backported across several stable branches, implying multiple maintained kernel series are impacted. Exact fixed release tags are not provided and should be confirmed against each stable branch's changelog.