CVE-2025-40158

Summary

In the Linux kernel, the following vulnerability has been resolved:

ipv6: use RCU in ip6_output()

Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF.

We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

Affected Software

VendorProductVersion RangeStatus
LinuxLinux4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 0393f85c3241c19ba8550f04a812e7d19f6b3082affected
LinuxLinux4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 11709573cc4e48dc34c80fc7ab9ce5b159e29695affected
LinuxLinux4.13affected
LinuxLinux0 < 4.13unaffected
LinuxLinux6.17.3 <= 6.17.*unaffected
LinuxLinux6.18 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References