Skip to main content

Linux Kernel CVE-2025-40139

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Local AF_SMC socket needs only unprivileged access (PR:L); the UAF is race-dependent (AC:H); realistic impact is crash/DoS (A:H) with a limited info leak (C:L), not integrity loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
4.7 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 09:05 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 09:04 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().

smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname().

Note that the returned value of smc_clc_prfx_set() is not used in the caller.

While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there.

AnalysisAI

Local denial of service and potential information disclosure in the Linux kernel's SMC (Shared Memory Communications) subsystem arises because smc_clc_prfx_set() dereferences sk_dst_get(sk)->dev during connect() without holding RCU or RTNL, creating a use-after-free window on the destination cache entry. A local user opening an AF_SMC socket can trigger the freed dst->dev access, risking a kernel crash or leaked memory. No public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not on CISA KEV; the upstream fix switches to __sk_dst_get()/dst_dev_rcu() under rcu_read_lock().

Technical ContextAI

SMC (Shared Memory Communications, RFC 7609) is a Linux kernel protocol family (AF_SMC) that transparently accelerates TCP-like connections over RDMA (SMC-R) or shared memory (SMC-D). During connection setup, smc_clc_prfx_set() computes the IP subnet prefix advertised in the SMC CLC handshake by inspecting the socket's routing destination (dst) and its associated net_device. The bug is a classic use-after-free (CWE-416, though NVD lists CWE as N/A): the code obtained the dst via sk_dst_get() and dereferenced ->dev outside any RCU read-side critical section or RTNL lock, so the referenced dst_entry/net_device could be freed concurrently by the networking stack. The fix uses __sk_dst_get() together with dst_dev_rcu() under rcu_read_lock() after kernel_getsockname(), and notes that smc_clc_prfx_set()'s return value is unused by the caller.

Affected ProductsAI

The affected product is the Linux kernel, specifically the SMC (Shared Memory Communications) networking subsystem in net/smc/smc_clc.c. NVD provides no CPE ranges and the CWE is unspecified, so exact affected version boundaries are not enumerated in the input; the fix landed via the stable tree as commits 0736993bfe5c7a9c744ae3fac62d769dfdae54e1 and 935d783e5de9b64587f3adb25641dd8385e64ddb (https://git.kernel.org/stable/c/0736993bfe5c7a9c744ae3fac62d769dfdae54e1 and https://git.kernel.org/stable/c/935d783e5de9b64587f3adb25641dd8385e64ddb). Only kernels with CONFIG_SMC enabled and the SMC protocol in use are practically exposed.

RemediationAI

Upstream fix available (stable commits 0736993bfe5c and 935d783e5de9; a released patched tag is not stated in the input), so update to the fixed stable/distribution kernel that incorporates these commits (https://git.kernel.org/stable/c/0736993bfe5c7a9c744ae3fac62d769dfdae54e1). Apply your distribution's kernel security update once it references CVE-2025-40139. As a compensating control where patching must be deferred, restrict or disable the SMC protocol: block loading of the smc module (e.g., an 'install smc /bin/true' modprobe rule or blacklist entry) or avoid enabling CONFIG_SMC, and prevent unprivileged creation of AF_SMC sockets; the trade-off is that any workload relying on SMC-R/SMC-D RDMA acceleration loses that transparent offload and falls back to standard TCP.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.82 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.55 Affected

Share

CVE-2025-40139 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy