Skip to main content

Linux Kernel CVE-2025-40075

HIGH
2025-10-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Establish many TCP connections to target
  2. Delivery
    Force route/device teardown concurrency
  3. Exploit
    Race unprotected dst_dev dereference
  4. Execution
    Read freed kernel memory or crash stack
  5. Impact
    Information disclosure or DoS

Vulnerability Assessment

Exploitation Conditions

Exploitation targets the tcp_metrics caching path, which requires TCP traffic that populates and accesses the destination metrics cache concurrently with netdevice/namespace teardown to hit the unprotected dst dereference window. Limiting factors: the CVSS AC:H rating signals a hard-to-win race requiring precise timing; the flaw lives in a defensive locking fix rather than a directly attacker-controlled parser, so no crafted payload alone triggers it. It also depends on the vulnerable kernel version being deployed with tcp_metrics active (the default), and practical impact hinges on concurrent route/interface state changes that an unprivileged remote attacker cannot directly control.
Impact

The signals are mixed and lean toward lower real-world priority than the 8.1 CVSS suggests. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) rates full CIA impact remotely, but AC:H already reflects the tight timing window inherent to a race condition, and the actual patch is a defensive locking-correctness change with no demonstrated exploit primitive. EPSS is very low (0.18%, 8th percentile), there is no KEV listing and no public POC, and the vendor tag classifies it as Information Disclosure rather than code execution - conflicting with the I:H/A:H claim. No SSVC decision data was provided. Net: this is a real kernel hardening fix worth patching through normal stable-update cadence, but not an emergency; the network-vector, remote, unauthenticated framing likely overstates practical exploitability given the race precondition. Note the tension: description implies a lockdep/RCU correctness fix (info-disclosure class) while CVSS asserts high integrity and availability impact - verify scope with kernel maintainers.
Exploit ScenarioDerived

An attacker able to drive high volumes of TCP connections to or from a target host attempts to win the narrow race between tcp_metrics dst access and concurrent route/device teardown (e.g., interface or namespace churn), aiming to read stale kernel memory or crash the network path. No public POC exists, and the AC:H rating reflects that reliably triggering the timing window is difficult, making opportunistic exploitation unlikely.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Information disclosure and memory-safety risk in the Linux kernel's TCP metrics (tcp_metrics) subsystem stems from three call sites using the non-lockdep-safe dst_dev() accessor, now replaced by the RCU-aware dst_dev_net_rcu() helper. Affected are Linux kernel builds prior to the fixing stable commits; a race in device/net dereference during TCP metric handling could expose kernel memory or destabilize the network stack. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not listed in CISA KEV.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that includes commits 07613a95326e, 4b89397807eb, and 50c127a69cd6 by updating to the latest patched stable release for your kernel series (via your distribution's kernel package: e.g. apt/yum/dnf/zypper update and reboot). References: https://git.kernel.org/stable/c/07613a95326ebad2d1b88d883cd72546025a4f3e, https://git.kernel.org/stable/c/4b89397807eb04986427c4786d065e9442834ad4, https://git.kernel.org/stable/c/50c127a69cd6285300931853b352a1918cfa180f. No standalone runtime workaround toggles this specific code path since tcp_metrics is core TCP stack behavior; as a partial compensating control you can flush and disable reliance on the metrics cache with 'sysctl net.ipv4.tcp_no_metrics_save=1' and 'ip tcp_metrics flush', which reduces cached-dst churn but does not fully eliminate the race and may slightly degrade TCP performance on repeated connections - patching remains the only reliable fix.

Affected ProductsAI

The Linux kernel's tcp_metrics code is affected in versions prior to the commits referenced at git.kernel.org/stable/c/07613a95326ebad2d1b88d883cd72546025a4f3e, /4b89397807eb04986427c4786d065e9442834ad4, and /50c127a69cd6285300931853b352a1918cfa180f (multiple stable branches receive backports). No CPE strings were supplied in the input, so exact version boundaries per stable series are not enumerated here; consult the individual stable commit headers for the precise kernel versions that received each backport.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The tcp_metrics cache stores per-destination TCP performance data (RTT, congestion window estimates) keyed off route destination (dst) entries. The fix swaps three dst_dev() calls for dst_dev_net_rcu(), a helper that carries lockdep annotations and enforces the RCU read-side locking contract when dereferencing the netdevice and its namespace from a dst. The underlying class of bug is a locking/concurrency defect (no CWE was assigned; behaviorally consistent with CWE-362 race condition and potential CWE-416 use-after-free) where the network device could be accessed without proper RCU protection, risking reads of freed or inconsistent state during concurrent route/device teardown.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.4 HIGH

Remote traffic reaches tcp_metrics (AV:N) but winning the race is hard (AC:H); a UAF-style read plausibly leaks memory (C:H) and can crash (A:H), while integrity impact is unsubstantiated (I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tcp_metrics: use dst_dev_net_rcu()

Replace three dst_dev() with a lockdep enabled helper.

Executive ViewAI

Why It Matters

A memory-safety vulnerability affecting Linux kernel networking (CVE-2025-40075, CVSS 8.1) could expose system memory or disrupt network service availability on affected infrastructure. While no public exploit has been identified, every Linux-running organization must immediately assess exposure to prepare for patching when vendor fixes become available.

Business Impact: Medium
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include implementing network segmentation to limit lateral movement from compromised systems, increasing monitoring on affected servers for anomalous kernel behavior or memory access patterns, and restricting administrative access to minimize exploitation vectors. Apply vendor patch immediately upon availability.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Prevalence
Ubiquitous
Linux kernel TCP stack runs in a vast fraction of production environments
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Medium

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.82 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.55 Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/330280 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4393/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4422/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4505/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4516/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4517/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0316/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20012/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20015/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20021/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20039/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20059/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20334/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20473/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20478/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20496/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20519/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20562/ REF https://git.kernel.org/stable/c/07613a95326ebad2d1b88d883cd72546025a4f3e REF https://git.kernel.org/stable/c/23261817e955ebeb91d7c5c667d09fa415eb88b4 REF https://git.kernel.org/stable/c/4b89397807eb04986427c4786d065e9442834ad4 REF https://git.kernel.org/stable/c/50c127a69cd6285300931853b352a1918cfa180f REF https://git.kernel.org/stable/c/7012bea5622396b37566fbdc059f7c6a6c279d74

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy