CVE-2025-40074

ipv4: start using dst_dev_rcu()

State: Published
Severity: 9.8 Critical
Published: Oct 28, 2025
Updated: Oct 3, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: start using dst_dev_rcu()

Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.

Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before 864155c164654110f68a17a63bd0339754790d67Affected 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before e150f273cd8ed34ebc6d03758aad95c12fc58337Affected 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before 684efb2c86c887685f9aa65e1a21b3df6c1f822dAffected 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before 923e0734c386984d45de508528a7a7ad91d791ccAffected 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8Affected
LinuxLinux	4.13Affected before 4.13Not affected 6.1.189 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.106 through 6.12.Not affected 6.17.3 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before 864155c164654110f68a17a63bd0339754790d67Affected
4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before e150f273cd8ed34ebc6d03758aad95c12fc58337Affected
4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before 684efb2c86c887685f9aa65e1a21b3df6c1f822dAffected
4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before 923e0734c386984d45de508528a7a7ad91d791ccAffected
4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 to before 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8Affected

LinuxLinux

4.13Affected
before 4.13Not affected
6.1.189 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.106 through 6.12.*Not affected
6.17.3 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.