CVE-2025-40149

HIGH EPSS 3.7%
Published Nov 12, 20257mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Nov 12, 2025 7mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the only ->ndo_sk_get_lower_dev() user is bond_sk_get_lower_dev(), which uses RCU.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
3.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 5

VendorProductVersionRange
linuxlinux_kernel*≥4.18  –  <5.15.199
linuxlinux_kernel*≥5.16  –  <6.1.161
linuxlinux_kernel*≥6.2  –  <6.6.121
linuxlinux_kernel*≥6.7  –  <6.12.66
linuxlinux_kernel*≥6.13  –  <6.17.3

References 6

  • git.kernel.org https://git.kernel.org/stable/c/13159c7125636371543a82cb7bbae00ab36730cc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2b1bef126bbb8d0da51491357559126d567c1dee
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c65f27b9c3be2269918e1cbad6d8884741f835c5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e37ca0092ddace60833790b4ad7a390408fb1be9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f09cd209359a23f88d4f3fa3d2379d057027e53c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/feb474ddbf26b51f462ae2e60a12013bdcfc5407
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/13159c7125636371543a82cb7bbae00ab36730cc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2b1bef126bbb8d0da51491357559126d567c1dee
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c65f27b9c3be2269918e1cbad6d8884741f835c5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e37ca0092ddace60833790b4ad7a390408fb1be9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f09cd209359a23f88d4f3fa3d2379d057027e53c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/feb474ddbf26b51f462ae2e60a12013bdcfc5407
    Patch