CVE-2025-40168

Summary

In the Linux kernel, the following vulnerability has been resolved:

smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().

smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Note that the returned value of smc_clc_prfx_match() is not used in the caller.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxa046d57da19f812216f393e7c535f5858f793ac3 < d26e80f7fb62d77757b67a1b94e4ac756bc9c658affected
LinuxLinuxa046d57da19f812216f393e7c535f5858f793ac3 < 235f81045c008169cc4e1955b4a64e118eebe61baffected
LinuxLinux4.11affected
LinuxLinux0 < 4.11unaffected
LinuxLinux6.17.3 <= 6.17.*unaffected
LinuxLinux6.18 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References