Skip to main content

Linux Kernel CVE-2025-40158

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.4 HIGH

Network-triggerable but a hard-to-win teardown race (AC:H), no auth (PR:N); a UAF plausibly leaks freed kernel memory (C:H) and crashes the host (A:H), with no demonstrated integrity write (I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 08:56 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 08:56 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.1 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: use RCU in ip6_output()

Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF.

We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

AnalysisAI

Denial-of-service and potential kernel information disclosure in the Linux kernel IPv6 stack arises from a use-after-free in ip6_output(), where the network device destination (dst) could be freed while still referenced during packet transmission. The fix wraps ip6_output() in an RCU read-side critical section and uses dst_dev_rcu() so the device pointer stays valid, removing now-redundant rcu_read_lock/unlock pairs from ip6_finish_output2(). No public exploit identified at time of analysis; EPSS is very low (0.03%) and the flaw is not in CISA KEV, but the CVSS 8.1 rating reflects the memory-safety impact of a UAF in the packet output path.

Technical ContextAI

The vulnerability lives in the kernel's IPv6 output path (net/ipv6/ip6_output.c). When the kernel transmits an IPv6 packet, ip6_output() dereferences the route/destination cache entry (struct dst_entry) and the associated net_device to make forwarding and neighbor decisions. Without holding an RCU read lock across the full output routine, the dst/device can be torn down concurrently (e.g., interface teardown, route flush, or dst garbage collection), leaving a dangling pointer that is subsequently dereferenced - a classic use-after-free (CWE-416; the record lists CWE as N/A). The remediation adopts RCU (read-copy-update) semantics and the dst_dev_rcu() helper to guarantee the device object remains valid for the duration of its use, which is why the lower-level rcu_read_lock()/rcu_read_unlock() calls in ip6_finish_output2() become unnecessary.

Affected ProductsAI

The Linux kernel IPv6 networking subsystem is affected. The exact affected version range is not enumerated in the provided data (no NVD CPE strings and CWE marked N/A); affected versions must be derived from the two upstream stable commits referenced (git.kernel.org/stable/c/0393f85c3241c19ba8550f04a812e7d19f6b3082 and git.kernel.org/stable/c/11709573cc4e48dc34c80fc7ab9ce5b159e29695), which identify the introducing and fixing points across the stable trees. Any distribution kernel with IPv6 enabled that predates backport of this fix should be considered potentially affected pending confirmation against the specific stable branch.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that incorporates the RCU fix to ip6_output(), tracked by the stable commits at git.kernel.org/stable/c/0393f85c3241c19ba8550f04a812e7d19f6b3082 and git.kernel.org/stable/c/11709573cc4e48dc34c80fc7ab9ce5b159e29695. In practice, upgrade to the patched point release of your distribution's kernel (consult your vendor's advisory mapping this CVE to their build) and reboot, or use live-patching where available. Because exploitation depends on processing IPv6 traffic through the output path, a targeted compensating control on hosts that do not require IPv6 is to disable IPv6 (e.g., net.ipv6.conf.all.disable_ipv6=1), which fully removes the affected code path but breaks any IPv6-dependent services and connectivity; where IPv6 is required, restrict exposure by limiting untrusted IPv6 ingress via firewall/ACLs, accepting that this reduces but does not eliminate the race window.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.83 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.91 Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2025-40158 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy