Linux Kernel
CVE-2025-40135
Lifecycle Timeline
2DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipv6: use RCU in ip6_xmit()
Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.
AnalysisAI
Linux kernel IPv6 packet transmission uses unsafe device reference handling in ip6_xmit() function, creating a use-after-free (UAF) vulnerability where the destination device pointer may be accessed after being freed. This affects all Linux kernel versions prior to patched stable releases, potentially allowing local or remote attackers to trigger memory corruption and information disclosure via crafted IPv6 traffic or network configuration changes. No active exploitation has been confirmed, and the EPSS score of 0.03% (10th percentile) indicates low real-world exploitation probability despite the underlying memory safety issue.
Technical ContextAI
The vulnerability resides in the IPv6 packet transmission path (ip6_xmit() function) in the Linux kernel networking stack. The root cause is improper synchronization when accessing the destination (dst) device pointer without Read-Copy-Update (RCU) locking semantics. When a destination device is freed while ip6_xmit() holds a reference to it, the function may dereference a dangling pointer via dst_dev_rcu(), triggering a use-after-free condition. This is classified as CWE-416 (Use After Free), a memory safety defect. The fix involves implementing proper RCU protection to ensure the device pointer remains valid during the critical section of IPv6 packet transmission. This affects the core IPv6 networking implementation across all Linux distributions.
Affected ProductsAI
The Linux kernel in all versions prior to patched stable releases is affected. The vulnerability was addressed across multiple stable kernel branches via upstream commits 9085e56501d93af9f2d7bd16f7fcfacdde47b99c, bd0905e2122e3680968cd0741966983490bf2ed3, f0a54d00d2f36de40266f47c27989853e8588656, f69fec6287565fdeb61f65e700a1184352306943, and f7f9e924f23684b4b23cd9f976cceab24a968e34 (available via https://git.kernel.org/stable/). All Linux distributions shipping unpatched kernels are transitively affected. Exact patched stable kernel versions vary by branch; users should consult kernel.org stable release notes and their distribution's security advisories for specific version mappings.
RemediationAI
Update the Linux kernel to a patched stable release that includes one of the referenced upstream commits (9085e56501d93af9f2d7bd16f7fcfacdde47b99c or derivatives). Check https://git.kernel.org/stable/ for patched versions in your kernel branch (5.10, 5.15, 6.1, 6.6, 6.12, etc.). Most distributions will release patched kernels automatically; subscribe to your distribution's security mailing list (e.g., linux-distros@kernel.org, Red Hat Security Advisories, Debian Security Updates, Ubuntu Security Notices) for availability. Until patching is feasible, deploying network segmentation to restrict IPv6 traffic from untrusted sources and disabling IPv6 if not required can reduce exposure surface, though these are incomplete workarounds and kernel patching remains the authoritative fix.
More in Linux Kernel
View allLinux kernel contains a flaw known as 'Dirty Pipe' where improper pipe buffer flag initialization allows unprivileged lo
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. Rated high severity (CVSS 7.0). Public ex
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr op
The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref
A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the h
Same technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today