Skip to main content

Linux Kernel CVE-2025-40158

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach host with IPv6 traffic
  2. Delivery
    Race transmit against dst teardown
  3. Exploit
    Trigger use-after-free in ip6_output
  4. Execution
    Kernel dereferences freed memory
  5. Impact
    Crash host or leak kernel memory

Vulnerability Assessment

Exploitation Conditions

Requires the target to be running an unpatched Linux kernel with IPv6 enabled and actively transmitting IPv6 packets through ip6_output(); exploitation hinges on winning a race between the IPv6 output path and concurrent teardown/freeing of the destination cache entry and its net_device. Limiting factors are significant: AC:H reflects a narrow, timing-dependent race window that is hard to trigger deterministically, exploitation is far more reliable under specific concurrency conditions (interface flaps, route flushes, high packet churn), and hosts with IPv6 disabled are not exposed. No authentication or user interaction is needed (PR:N/UI:N), but the practical prerequisite of hitting the race makes opportunistic mass exploitation unlikely.
Impact

The signals are mixed and should temper the raw score. The published CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1) rates this High: network-reachable and unauthenticated, but explicitly high attack complexity (AC:H) because triggering a UAF requires winning a narrow timing race between packet transmission and dst/device teardown. EPSS is 0.03% (10th percentile) and there is no KEV listing and no known POC, all consistent with a hard-to-weaponize race rather than a mass-exploitable bug. There is a notable tension between the vendor tag 'Information Disclosure' and the CVSS claim of full C:H/I:H/A:H - in practice a UAF in the output path most plausibly yields a kernel crash (DoS) and possible leakage of freed kernel memory, while reliable integrity/RCE via this race is speculative; treat the I:H/A:H claim as an upper bound, not a demonstrated capability. Net assessment: real but low-probability, patch-in-normal-cycle risk for most fleets, higher priority only for systems processing high volumes of attacker-influenced IPv6 traffic.
Exploit ScenarioDerived

An attacker sends a stream of IPv6 packets to a target host while concurrently inducing route/interface state changes (or relies on naturally occurring dst teardown under load) to race the ip6_output() transmit path against destination-cache freeing. If the race is won, the kernel dereferences freed memory, most likely crashing the host (DoS) or exposing residual freed-memory contents. No public POC is known, and the high attack complexity makes reliable exploitation difficult.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 30, 2026

Denial-of-service and potential kernel information disclosure in the Linux kernel IPv6 stack arises from a use-after-free in ip6_output(), where the network device destination (dst) could be freed while still referenced during packet transmission. The fix wraps ip6_output() in an RCU read-side critical section and uses dst_dev_rcu() so the device pointer stays valid, removing now-redundant rcu_read_lock/unlock pairs from ip6_finish_output2(). No public exploit identified at time of analysis; EPSS is very low (0.03%) and the flaw is not in CISA KEV, but the CVSS 8.1 rating reflects the memory-safety impact of a UAF in the packet output path.

Earlier versions of this analysis (2)
v2 Jul 30, 2026 - 08:56 cvss changed CVSS 8.1

A use-after-free race condition in the Linux kernel's IPv6 output path (ip6_output()) allows the network stack to dereference a network device structure that may be freed concurrently, potentially leaking kernel memory or crashing the system. The flaw affects the IPv6 transmit path and was resolved by converting ip6_output() to use RCU-protected device access (dst_dev_rcu()). It carries a CVSS score of 8.1 (AV:N/AC:H) but a very low EPSS of 0.03%, and there is no public exploit identified at time of analysis.

v1 Mar 28, 2026 - 19:21

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. No vendor patch available.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that incorporates the RCU fix to ip6_output(), tracked by the stable commits at git.kernel.org/stable/c/0393f85c3241c19ba8550f04a812e7d19f6b3082 and git.kernel.org/stable/c/11709573cc4e48dc34c80fc7ab9ce5b159e29695. In practice, upgrade to the patched point release of your distribution's kernel (consult your vendor's advisory mapping this CVE to their build) and reboot, or use live-patching where available. Because exploitation depends on processing IPv6 traffic through the output path, a targeted compensating control on hosts that do not require IPv6 is to disable IPv6 (e.g., net.ipv6.conf.all.disable_ipv6=1), which fully removes the affected code path but breaks any IPv6-dependent services and connectivity; where IPv6 is required, restrict exposure by limiting untrusted IPv6 ingress via firewall/ACLs, accepting that this reduces but does not eliminate the race window.

Affected ProductsAI

The Linux kernel IPv6 networking subsystem is affected. The exact affected version range is not enumerated in the provided data (no NVD CPE strings and CWE marked N/A); affected versions must be derived from the two upstream stable commits referenced (git.kernel.org/stable/c/0393f85c3241c19ba8550f04a812e7d19f6b3082 and git.kernel.org/stable/c/11709573cc4e48dc34c80fc7ab9ce5b159e29695), which identify the introducing and fixing points across the stable trees. Any distribution kernel with IPv6 enabled that predates backport of this fix should be considered potentially affected pending confirmation against the specific stable branch.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in the kernel's IPv6 output path (net/ipv6/ip6_output.c). When the kernel transmits an IPv6 packet, ip6_output() dereferences the route/destination cache entry (struct dst_entry) and the associated net_device to make forwarding and neighbor decisions. Without holding an RCU read lock across the full output routine, the dst/device can be torn down concurrently (e.g., interface teardown, route flush, or dst garbage collection), leaving a dangling pointer that is subsequently dereferenced - a classic use-after-free (CWE-416; the record lists CWE as N/A). The remediation adopts RCU (read-copy-update) semantics and the dst_dev_rcu() helper to guarantee the device object remains valid for the duration of its use, which is why the lower-level rcu_read_lock()/rcu_read_unlock() calls in ip6_finish_output2() become unnecessary.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.4 HIGH

Network-triggerable but a hard-to-win teardown race (AC:H), no auth (PR:N); a UAF plausibly leaks freed kernel memory (C:H) and crashes the host (A:H), with no demonstrated integrity write (I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Updated
Jul 30, 2026 - 08:56 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 30, 2026 - 08:56 vuln.today
v2 - CVSS changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.1 (HIGH)
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: use RCU in ip6_output()

Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF.

We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

Executive ViewAI

Why It Matters

A memory-safety vulnerability in the Linux kernel's IPv6 stack (CVE-2025-40158, CVSS 8.1) could enable denial-of-service attacks or kernel memory disclosure on IPv6-enabled Linux systems across your infrastructure. Organizations face potential service disruption and data exposure; the absence of vendor patches requires immediate deployment of interim controls. The high technical severity combined with network-exploitability demands priority mitigation despite current low exploitation likelihood.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: disable IPv6 on non-critical systems where it is not operationally required; implement network-level rate limiting, traffic filtering, and segmentation for IPv6 traffic; deploy kernel panic and DoS detection monitoring with alerting; maintain pre-staging of kernel update procedures for rapid deployment once patches become available.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Prevalence
Ubiquitous
Linux kernel with IPv6 runs on the vast majority of servers and devices
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.83 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.91 Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:1690 ADVISORY https://access.redhat.com/errata/RHSA-2026:2212 ADVISORY https://access.redhat.com/errata/RHSA-2026:2264 ADVISORY https://access.redhat.com/errata/RHSA-2026:22964 ADVISORY https://access.redhat.com/errata/RHSA-2026:23237 ADVISORY https://access.redhat.com/errata/RHSA-2026:2378 ADVISORY https://access.redhat.com/errata/RHSA-2026:25218 ADVISORY https://access.redhat.com/errata/RHSA-2026:25533 ADVISORY https://access.redhat.com/errata/RHSA-2026:26462 ADVISORY https://access.redhat.com/errata/RHSA-2026:26515 ADVISORY https://access.redhat.com/errata/RHSA-2026:26535 ADVISORY https://access.redhat.com/errata/RHSA-2026:27731 ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/332172 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0278/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0281/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0293/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0315/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0316/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20012/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20015/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20021/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20498/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20562/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ REF https://git.kernel.org/stable/c/0393f85c3241c19ba8550f04a812e7d19f6b3082 REF https://git.kernel.org/stable/c/11709573cc4e48dc34c80fc7ab9ce5b159e29695 REF https://git.kernel.org/stable/c/423895685f367b5a0a956bd14b02df0192bded4c REF https://git.kernel.org/stable/c/4549ce1057363c8dc072f40c6aa591c279eafed2 REF https://git.kernel.org/stable/c/92803b826e40e49a5e8a6e208f4b4574e9d19426

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy