Skip to main content

Linux Kernel CVE-2025-40168

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Remote SMC peer with no auth (AV:N/PR:N) but must win a narrow dst-teardown race (AC:H); a kernel UAF can in principle yield full memory-corruption impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 08:48 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 08:48 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.1 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().

smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Note that the returned value of smc_clc_prfx_match() is not used in the caller.

AnalysisAI

Use-after-free in the Linux kernel's SMC (Shared Memory Communications) protocol handler smc_clc_prfx_match() lets a remote peer potentially trigger memory corruption during connection establishment. The flaw stems from dereferencing a destination cache device pointer (sk_dst_get(sk)->dev) outside RCU/RTNL protection in the listen path, so the dst entry can be freed concurrently. There is no public exploit identified at time of analysis and the EPSS probability is negligible (0.03%); notably the function's return value is unused by its caller, further limiting practical impact.

Technical ContextAI

SMC is a Linux kernel network protocol (AF_SMC) that transparently accelerates TCP-style traffic over RDMA (SMC-R) or shared memory (SMC-D). During inbound connection setup, smc_listen_work() calls smc_clc_prfx_match() to compare the peer's advertised IP prefixes against the local interface. That code used sk_dst_get(sk)->dev to reach the outbound network device, but the SMC listen worker does not run under RCU read-side lock or RTNL, so the referenced dst_entry (and its net_device) can be released by another CPU between lookup and dereference - a classic use-after-free (CWE-416). The fix switches to __sk_dst_get() plus the dst_dev_rcu() helper, which obtain the device under proper RCU protection. No CPE strings were supplied in the intelligence, so exact affected kernel version ranges must be derived from the stable-tree commits.

Affected ProductsAI

The affected product is the Linux kernel, specifically the SMC (AF_SMC / Shared Memory Communications) subsystem in net/smc. No CPE strings or explicit version ranges were provided in the intelligence feed, so precise affected/fixed kernel versions must be read from the stable-tree fix commits at https://git.kernel.org/stable/c/235f81045c008169cc4e1955b4a64e118eebe61b and https://git.kernel.org/stable/c/d26e80f7fb62d77757b67a1b94e4ac756bc9c658. Only kernels built with SMC support (CONFIG_SMC) and with the subsystem in use are practically exposed.

RemediationAI

Upstream fix available (PR/commit); a released patched version is not independently confirmed from the provided data - apply the stable-kernel commits 235f81045c008169cc4e1955b4a64e118eebe61b and d26e80f7fb62d77757b67a1b94e4ac756bc9c658, which replace the unsafe sk_dst_get(sk)->dev usage with __sk_dst_get() and dst_dev_rcu(). Prefer updating to your distribution's next patched kernel release that incorporates these commits rather than hand-cherry-picking. As a compensating control where patching is delayed, disable or block SMC if it is not required: unload/blacklist the smc module (or avoid CONFIG_SMC), which fully removes the attack surface with the trade-off of losing SMC-R/SMC-D acceleration; where SMC is needed, restrict which peers can open SMC connections via network segmentation and firewalling of the RDMA/SMC path. Consult the referenced kernel.org commits for exact backport applicability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.82 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.55 Affected

Share

CVE-2025-40168 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy