Skip to main content

Linux Kernel CVE-2025-40170

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.3 MEDIUM

Local trigger (AV:L) via code execution (PR:L); winning the dst->dev race is timing-dependent (AC:H); UAF read leaks kernel memory (C:H) and can panic (A:H) with no clear integrity write (I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat
7.4 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 08:46 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 08:45 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: use dst_dev_rcu() in sk_setup_caps()

Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size().

Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward().

ip4_dst_hoplimit() can use dst_dev_net_rcu().

AnalysisAI

Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.

Technical ContextAI

The Linux kernel caches route/destination state in dst_entry structures, each referencing an outbound net_device via dst->dev. Socket egress setup (sk_setup_caps(), sk_dst_gso_max_size()) and the forwarding MTU/hop-limit helpers (ip6_dst_mtu_maybe_forward(), ip_dst_mtu_maybe_forward(), ip4_dst_hoplimit()) read dst->dev directly. Because the device backing a dst can change or be released concurrently, reading the raw pointer without holding the RCU read-side lock is a data race on a lifetime-managed object - the class of defect corresponding to CWE-416 (use-after-free) / CWE-362 (race condition). The fix wraps these accesses in dst_dev_rcu() and dst_dev_net_rcu(), which return the device safely under RCU so a freed pointer is never dereferenced. CWE is listed as N/A in the source data, so the root-cause class here is inferred from the patch semantics.

Affected ProductsAI

The Linux kernel is affected in the versions preceding the commits that introduced the RCU-safe dst_dev accessors in the networking core; the exact vulnerable range is not enumerated in the provided NVD data (no CPE strings supplied). Fixes were backported to stable trees, evidenced by three stable-tree commits: https://git.kernel.org/stable/c/5d1be493d1110c9e720b4c51a6e587bb2fb4ac12, https://git.kernel.org/stable/c/99a2ace61b211b0be861b07fbaa062fca4b58879, and https://git.kernel.org/stable/c/a805729c0091073d8f0415cfa96c7acd1bc17a48. Distributions shipping kernels built before these commits (across common enterprise and general-purpose distros) should be considered affected until their respective stable/backport version is confirmed.

RemediationAI

Upstream fix available (three stable-tree commits); a specific tagged release version is not enumerated in the provided data, so apply the patched stable kernel from your distribution once it incorporates commits 5d1be493, 99a2ace6, and a805729c (see the git.kernel.org URLs above). Practically, update to the latest stable/LTS point release from your distribution vendor and reboot into the new kernel. There is no meaningful application-layer workaround for an in-kernel race; compensating controls reduce exposure to local attackers rather than fix the flaw: restrict local shell/code-execution access on the host (the bug requires local execution), and on multi-tenant systems limit untrusted user workloads via namespaces/seccomp and reduced local privileges. These controls limit who can attempt to trigger the race but do not eliminate it, so patching remains the only complete remediation.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40170 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy