Linux Kernel CVE-2025-40135

Patch available per vendor advisory: apply the upstream fix via the stable-tree commits (9085e56501d9, bd0905e2122e, f0a54d00d2f3, f69fec628756, f7f9e924f236 at https://git.kernel.org/stable/) or, more practically, update to your distribution's patched kernel - Ubuntu users should install the kernel update tracked in USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) and reboot. Siemens operators should follow product-specific guidance in SSA-019113 and SSA-082556. Because the flaw is intrinsic to the IPv6 transmit path, there is no clean feature-level workaround; the only robust mitigation short of patching is to disable IPv6 where it is not required (e.g., sysctl net.ipv6.conf.all.disable_ipv6=1 or booting with ipv6.disable=1), which removes the vulnerable code path entirely but will break any IPv6-dependent services and connectivity - a heavy trade-off acceptable only in IPv4-only environments. Reducing exposure to untrusted networks and limiting the ability to induce rapid route/interface state changes offers marginal risk reduction but does not close the race.