CVE-2025-40139

smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().

State: Published
Severity: 7.8 High
Published: Nov 12, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().

smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname().

Note that the returned value of smc_clc_prfx_set() is not used in the caller.

While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a046d57da19f812216f393e7c535f5858f793ac3 to before 5a2fccc4b32c13ddde3676f9e15e1a9baa7d6fdeAffected a046d57da19f812216f393e7c535f5858f793ac3 to before 80d1fd39f4e37d836655e9f7ffccaf78925049bfAffected a046d57da19f812216f393e7c535f5858f793ac3 to before 956c57daba55cf9ed25d9f2512883b8a1a927599Affected a046d57da19f812216f393e7c535f5858f793ac3 to before 0736993bfe5c7a9c744ae3fac62d769dfdae54e1Affected a046d57da19f812216f393e7c535f5858f793ac3 to before 935d783e5de9b64587f3adb25641dd8385e64ddbAffected
LinuxLinux	4.11Affected before 4.11Not affected 6.1.187 through 6.1.Not affected 6.6.156 through 6.6.Not affected 6.12.108 through 6.12.Not affected 6.17.3 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

a046d57da19f812216f393e7c535f5858f793ac3 to before 5a2fccc4b32c13ddde3676f9e15e1a9baa7d6fdeAffected
a046d57da19f812216f393e7c535f5858f793ac3 to before 80d1fd39f4e37d836655e9f7ffccaf78925049bfAffected
a046d57da19f812216f393e7c535f5858f793ac3 to before 956c57daba55cf9ed25d9f2512883b8a1a927599Affected
a046d57da19f812216f393e7c535f5858f793ac3 to before 0736993bfe5c7a9c744ae3fac62d769dfdae54e1Affected
a046d57da19f812216f393e7c535f5858f793ac3 to before 935d783e5de9b64587f3adb25641dd8385e64ddbAffected

LinuxLinux

4.11Affected
before 4.11Not affected
6.1.187 through 6.1.*Not affected
6.6.156 through 6.6.*Not affected
6.12.108 through 6.12.*Not affected
6.17.3 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.