Skip to main content

Linux Kernel CVE-2025-40170

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local execution on host
  2. Delivery
    Set up sockets and routes for a destination
  3. Exploit
    Concurrently trigger device/dst teardown
  4. Execution
    Race unprotected dst->dev dereference
  5. Impact
    Read freed kernel memory or crash kernel

Vulnerability Assessment

Exploitation Conditions

Requires local code execution on the target host (AV:L, PR:L) to drive the networking egress/forwarding code paths that read dst->dev - specifically the socket setup path (sk_setup_caps/sk_dst_gso_max_size) or the IPv4/IPv6 forwarding MTU/hop-limit helpers. Exploitation is limited by a race window: an attacker must trigger concurrent destination/device teardown while the vulnerable dereference occurs, so success is timing-dependent and non-deterministic. No remote vector, no user interaction, and no special product feature toggle is required beyond normal networking activity; the limiting factors are the need for local access and winning the concurrency race, which substantially reduces practical exploitability despite the 7.8 base score.
Impact

The vendor-assigned CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H = 7.8) reflects Linux's conservative auto-scoring for memory-safety races and likely overstates real-world severity: triggering a use-after-free on dst->dev requires winning a narrow timing race, which argues for higher attack complexity (AC:H) than the assigned AC:L, and the practical outcome of an unprotected pointer read is kernel-memory disclosure or a crash rather than reliable full integrity compromise. Supporting signals are all low: EPSS is 0.03% (9th percentile), the vulnerability is not in CISA KEV, and no POC is referenced. The 'Information Disclosure' tag conflicts with the C:H/I:H/A:H vendor vector - the tag implies confidentiality/DoS impact, not integrity, so the I:H rating should be treated skeptically. Net assessment: a legitimate but low-priority local hardening fix, not an urgent remotely-exploitable threat; patch through normal kernel update cadence.
Exploit ScenarioDerived

A local unprivileged or low-privileged user runs code that rapidly creates and tears down sockets/routes while another CPU processes egress or forwarding for the same destination, racing to dereference dst->dev after the device is freed. Successful timing yields a read of freed kernel memory (potential leak of kernel data) or a kernel panic/denial of service. No public exploit is identified, and reliably winning the race is non-trivial.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 30, 2026

Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.

Earlier versions of this analysis (2)
v2 Jul 30, 2026 - 08:45 cvss changed CVSS 7.8

Memory-safety flaw in the Linux kernel networking stack where sk_setup_caps() and related routing helpers (sk_dst_gso_max_size(), ip6_dst_mtu_maybe_forward(), ip_dst_mtu_maybe_forward(), ip4_dst_hoplimit()) accessed dst->dev without RCU protection, creating a race a local user can trigger. Tagged as information disclosure, it carries a 7.8 CVSS (local, low-privilege) with high confidentiality, integrity and availability impact, though EPSS is negligible (0.03%, 9th percentile). There is no public exploit identified at time of analysis and it is not in CISA KEV; the fix ships as upstream stable-tree commits.

v1 Mar 28, 2026 - 19:21

In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). No vendor patch available.

RemediationAI

Upstream fix available (three stable-tree commits); a specific tagged release version is not enumerated in the provided data, so apply the patched stable kernel from your distribution once it incorporates commits 5d1be493, 99a2ace6, and a805729c (see the git.kernel.org URLs above). Practically, update to the latest stable/LTS point release from your distribution vendor and reboot into the new kernel. There is no meaningful application-layer workaround for an in-kernel race; compensating controls reduce exposure to local attackers rather than fix the flaw: restrict local shell/code-execution access on the host (the bug requires local execution), and on multi-tenant systems limit untrusted user workloads via namespaces/seccomp and reduced local privileges. These controls limit who can attempt to trigger the race but do not eliminate it, so patching remains the only complete remediation.

Affected ProductsAI

The Linux kernel is affected in the versions preceding the commits that introduced the RCU-safe dst_dev accessors in the networking core; the exact vulnerable range is not enumerated in the provided NVD data (no CPE strings supplied). Fixes were backported to stable trees, evidenced by three stable-tree commits: https://git.kernel.org/stable/c/5d1be493d1110c9e720b4c51a6e587bb2fb4ac12, https://git.kernel.org/stable/c/99a2ace61b211b0be861b07fbaa062fca4b58879, and https://git.kernel.org/stable/c/a805729c0091073d8f0415cfa96c7acd1bc17a48. Distributions shipping kernels built before these commits (across common enterprise and general-purpose distros) should be considered affected until their respective stable/backport version is confirmed.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux kernel caches route/destination state in dst_entry structures, each referencing an outbound net_device via dst->dev. Socket egress setup (sk_setup_caps(), sk_dst_gso_max_size()) and the forwarding MTU/hop-limit helpers (ip6_dst_mtu_maybe_forward(), ip_dst_mtu_maybe_forward(), ip4_dst_hoplimit()) read dst->dev directly. Because the device backing a dst can change or be released concurrently, reading the raw pointer without holding the RCU read-side lock is a data race on a lifetime-managed object - the class of defect corresponding to CWE-416 (use-after-free) / CWE-362 (race condition). The fix wraps these accesses in dst_dev_rcu() and dst_dev_net_rcu(), which return the device safely under RCU so a freed pointer is never dereferenced. CWE is listed as N/A in the source data, so the root-cause class here is inferred from the patch semantics.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.3 MEDIUM

Local trigger (AV:L) via code execution (PR:L); winning the dst->dev race is timing-dependent (AC:H); UAF read leaks kernel memory (C:H) and can panic (A:H) with no clear integrity write (I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat 7.4 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Updated
Jul 30, 2026 - 08:46 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 30, 2026 - 08:45 vuln.today
v2 - CVSS changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: use dst_dev_rcu() in sk_setup_caps()

Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size().

Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward().

ip4_dst_hoplimit() can use dst_dev_net_rcu().

Executive ViewAI

Why It Matters

CVE-2025-40170 is a local kernel networking vulnerability in Linux systems that can disclose sensitive information and potentially destabilize system operations through use-after-free conditions in the networking stack. No vendor patch is currently available, and exploitation likelihood remains minimal (0.03% EPSS) with no known public exploits. Organizations must inventory affected systems and implement protective measures through access controls and monitoring while preparing for remediation when patches become available.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include enforcing local access restrictions through user privilege separation, enhanced monitoring for kernel instability and memory error events, and maintaining an updated inventory of affected systems for rapid deployment when patches release.

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Prevalence
Ubiquitous
Linux kernel networking core runs in nearly all Linux deployments
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:1690 ADVISORY https://access.redhat.com/errata/RHSA-2026:2212 ADVISORY https://access.redhat.com/errata/RHSA-2026:2264 ADVISORY https://access.redhat.com/errata/RHSA-2026:22964 ADVISORY https://access.redhat.com/errata/RHSA-2026:23237 ADVISORY https://access.redhat.com/errata/RHSA-2026:2378 ADVISORY https://access.redhat.com/errata/RHSA-2026:25218 ADVISORY https://access.redhat.com/errata/RHSA-2026:25533 ADVISORY https://access.redhat.com/errata/RHSA-2026:26462 ADVISORY https://access.redhat.com/errata/RHSA-2026:26515 ADVISORY https://access.redhat.com/errata/RHSA-2026:26535 ADVISORY https://access.redhat.com/errata/RHSA-2026:27731 ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/332135 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0278/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0281/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0293/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0315/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0316/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20207/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20220/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20228/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20498/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20564/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ REF https://git.kernel.org/stable/c/13b0e14bfa7e6d506d8d6426b9e6d7feef01ded3 REF https://git.kernel.org/stable/c/5d1be493d1110c9e720b4c51a6e587bb2fb4ac12 REF https://git.kernel.org/stable/c/99a2ace61b211b0be861b07fbaa062fca4b58879 REF https://git.kernel.org/stable/c/9f22b5f7f1a32f8bbcc82bf34e34ea63523fcd02 REF https://git.kernel.org/stable/c/a805729c0091073d8f0415cfa96c7acd1bc17a48

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy