CVE-2025-40135
Lifecycle Timeline
2Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.
Analysis
Linux kernel IPv6 packet transmission uses unsafe device reference handling in ip6_xmit() function, creating a use-after-free (UAF) vulnerability where the destination device pointer may be accessed after being freed. This affects all Linux kernel versions prior to patched stable releases, potentially allowing local or remote attackers to trigger memory corruption and information disclosure via crafted IPv6 traffic or network configuration changes. No active exploitation has been confirmed, and the EPSS score of 0.03% (10th percentile) indicates low real-world exploitation probability despite the underlying memory safety issue.
Technical Context
The vulnerability resides in the IPv6 packet transmission path (ip6_xmit() function) in the Linux kernel networking stack. The root cause is improper synchronization when accessing the destination (dst) device pointer without Read-Copy-Update (RCU) locking semantics. When a destination device is freed while ip6_xmit() holds a reference to it, the function may dereference a dangling pointer via dst_dev_rcu(), triggering a use-after-free condition. This is classified as CWE-416 (Use After Free), a memory safety defect. The fix involves implementing proper RCU protection to ensure the device pointer remains valid during the critical section of IPv6 packet transmission. This affects the core IPv6 networking implementation across all Linux distributions.
Affected Products
The Linux kernel in all versions prior to patched stable releases is affected. The vulnerability was addressed across multiple stable kernel branches via upstream commits 9085e56501d93af9f2d7bd16f7fcfacdde47b99c, bd0905e2122e3680968cd0741966983490bf2ed3, f0a54d00d2f36de40266f47c27989853e8588656, f69fec6287565fdeb61f65e700a1184352306943, and f7f9e924f23684b4b23cd9f976cceab24a968e34 (available via https://git.kernel.org/stable/). All Linux distributions shipping unpatched kernels are transitively affected. Exact patched stable kernel versions vary by branch; users should consult kernel.org stable release notes and their distribution's security advisories for specific version mappings.
Remediation
Update the Linux kernel to a patched stable release that includes one of the referenced upstream commits (9085e56501d93af9f2d7bd16f7fcfacdde47b99c or derivatives). Check https://git.kernel.org/stable/ for patched versions in your kernel branch (5.10, 5.15, 6.1, 6.6, 6.12, etc.). Most distributions will release patched kernels automatically; subscribe to your distribution's security mailing list (e.g., [email protected], Red Hat Security Advisories, Debian Security Updates, Ubuntu Security Notices) for availability. Until patching is feasible, deploying network segmentation to restrict IPv6 traffic from untrusted sources and disabling IPv6 if not required can reduce exposure surface, though these are incomplete workarounds and kernel patching remains the authoritative fix.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today