Skip to main content

Linux Kernel CVE-2025-40075

HIGH
2025-10-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.4 HIGH

Remote traffic reaches tcp_metrics (AV:N) but winning the race is hard (AC:H); a UAF-style read plausibly leaks memory (C:H) and can crash (A:H), while integrity impact is unsubstantiated (I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:45 vuln.today
CVE Published
Oct 28, 2025 - 12:15 cve.org
HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tcp_metrics: use dst_dev_net_rcu()

Replace three dst_dev() with a lockdep enabled helper.

AnalysisAI

Information disclosure and memory-safety risk in the Linux kernel's TCP metrics (tcp_metrics) subsystem stems from three call sites using the non-lockdep-safe dst_dev() accessor, now replaced by the RCU-aware dst_dev_net_rcu() helper. Affected are Linux kernel builds prior to the fixing stable commits; a race in device/net dereference during TCP metric handling could expose kernel memory or destabilize the network stack. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not listed in CISA KEV.

Technical ContextAI

The tcp_metrics cache stores per-destination TCP performance data (RTT, congestion window estimates) keyed off route destination (dst) entries. The fix swaps three dst_dev() calls for dst_dev_net_rcu(), a helper that carries lockdep annotations and enforces the RCU read-side locking contract when dereferencing the netdevice and its namespace from a dst. The underlying class of bug is a locking/concurrency defect (no CWE was assigned; behaviorally consistent with CWE-362 race condition and potential CWE-416 use-after-free) where the network device could be accessed without proper RCU protection, risking reads of freed or inconsistent state during concurrent route/device teardown.

Affected ProductsAI

The Linux kernel's tcp_metrics code is affected in versions prior to the commits referenced at git.kernel.org/stable/c/07613a95326ebad2d1b88d883cd72546025a4f3e, /4b89397807eb04986427c4786d065e9442834ad4, and /50c127a69cd6285300931853b352a1918cfa180f (multiple stable branches receive backports). No CPE strings were supplied in the input, so exact version boundaries per stable series are not enumerated here; consult the individual stable commit headers for the precise kernel versions that received each backport.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that includes commits 07613a95326e, 4b89397807eb, and 50c127a69cd6 by updating to the latest patched stable release for your kernel series (via your distribution's kernel package: e.g. apt/yum/dnf/zypper update and reboot). References: https://git.kernel.org/stable/c/07613a95326ebad2d1b88d883cd72546025a4f3e, https://git.kernel.org/stable/c/4b89397807eb04986427c4786d065e9442834ad4, https://git.kernel.org/stable/c/50c127a69cd6285300931853b352a1918cfa180f. No standalone runtime workaround toggles this specific code path since tcp_metrics is core TCP stack behavior; as a partial compensating control you can flush and disable reliance on the metrics cache with 'sysctl net.ipv4.tcp_no_metrics_save=1' and 'ip tcp_metrics flush', which reduces cached-dst churn but does not fully eliminate the race and may slightly degrade TCP performance on repeated connections - patching remains the only reliable fix.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.82 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.55 Affected

Share

CVE-2025-40075 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy