CVE-2025-40074 (GCVE-0-2025-40074)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07
VLAI
Title
ipv4: start using dst_dev_rcu()
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: start using dst_dev_rcu() Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF. Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 , < 923e0734c386984d45de508528a7a7ad91d791cc (git)
Affected: 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 , < 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8 (git)
Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/icmp.c",
            "net/ipv4/ip_fragment.c",
            "net/ipv4/ipmr.c",
            "net/ipv4/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "923e0734c386984d45de508528a7a7ad91d791cc",
              "status": "affected",
              "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
              "versionType": "git"
            },
            {
              "lessThan": "6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8",
              "status": "affected",
              "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/icmp.c",
            "net/ipv4/ip_fragment.c",
            "net/ipv4/ipmr.c",
            "net/ipv4/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: start using dst_dev_rcu()\n\nChange icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.\n\nChange ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),\nipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Every fixed site is on a pure packet-processing path \u2014 `icmpv4_xrlim_allow()` runs on inbound ICMP echo requests and on ICMP error generation, `ip_defrag()` runs on inbound IPv4 fragments via `ip_local_deliver()`, the conntrack/IPVS/OVS defrag hooks, and the `ipmr_*` sites forward remote multicast traffic. No local access is required to reach the vulnerable code.\nAC:L - An attacker can flood fragmented IPv4 datagrams and ICMP-error-provoking packets continuously, keeping `ip_defrag()` and `icmpv4_xrlim_allow()` executing on the unprotected `dst-\u003edev` fetch at very high rates, so the window is sampled constantly rather than once; on the common deployments where the dst-device teardown is routine and attacker-influenceable (PPPoE/L2TP session churn on a BRAS, tunnel and virtual-interface teardown in cloud/container hosts, route-exception churn the attacker drives with ICMP redirect and PMTU messages), the race is repeatable at will rather than dependent on a condition the attacker cannot reach.\nPR:N - ICMP echo replies and IPv4 fragment reassembly are handled before any authentication or authorization step exists, and there is no capability check anywhere on the path from packet receive to the unprotected `dst-\u003edev` dereference. Any unauthenticated host that can send IP packets to the target reaches this code.\nUI:N - The vulnerable code executes entirely in softirq context on packet receive and in the ICMP/multicast transmit paths; no local user or administrator has to open, mount, or click anything.\nS:U - The stale dereference and any resulting corruption stay inside the kernel\u0027s own memory and the network stack, which is a single security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Reading a freed `struct net_device` yields `dev-\u003eflags` and, through `l3mdev_master_ifindex_rcu()`, an rcu-dereferenced walk of the upper-device list and a master ifindex, all taken from reclaimed memory; an attacker who grooms the slab into that allocation gets kernel memory interpreted as device state and used to select fragment-reassembly queues and ICMP peer entries, enabling disclosure of kernel memory.\nI:H - The garbage ifindex derived from the freed device becomes the `vif` key for `ip_find()`, steering fragment reassembly into attacker-chosen queues, and the same freed-object pointer feeds `inet_getpeer_v4()`; a use-after-free of a `net_device` of this class is leverageable via heap spraying into controlled kernel writes and control-flow hijack.\nA:H - Dereferencing a released `net_device` and following its upper-device list pointers into freed memory produces an oops or panic in softirq context, taking down the entire system, and it is triggerable by ordinary remote traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:33.583Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/923e0734c386984d45de508528a7a7ad91d791cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8"
        }
      ],
      "title": "ipv4: start using dst_dev_rcu()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40074",
    "datePublished": "2025-10-28T11:48:41.202Z",
    "dateReserved": "2025-04-16T07:20:57.160Z",
    "dateUpdated": "2026-08-05T12:07:33.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40074",
      "date": "2026-08-10",
      "epss": "0.00369",
      "percentile": "0.29588"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:46:11.000Z",
      "cve": "CVE-2025-40074",
      "id": "msrc_CVE-2025-40074",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:known_affected": "14",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ipv4: start using dst_dev_rcu()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40074.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40074\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-28T12:15:41.943\",\"lastModified\":\"2026-07-30T06:24:09.770\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv4: start using dst_dev_rcu()\\n\\nChange icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.\\n\\nChange ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),\\nipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/icmp.c\",\"net/ipv4/ip_fragment.c\",\"net/ipv4/ipmr.c\",\"net/ipv4/route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36\",\"lessThan\":\"923e0734c386984d45de508528a7a7ad91d791cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36\",\"lessThan\":\"6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/icmp.c\",\"net/ipv4/ip_fragment.c\",\"net/ipv4/ipmr.c\",\"net/ipv4/route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.3\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/923e0734c386984d45de508528a7a7ad91d791cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:52:52+00:00",
      "cve": "CVE-2025-40074",
      "id": "CVE-2025-40074",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv4: start using dst_dev_rcu()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40074.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:46:53Z",
      "cve": "CVE-2025-40074",
      "id": "CVE-2025-40074",
      "initial_release_date": "2025-10-29T00:24:43Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "638",
      "product_status:known_not_affected": "22",
      "product_status:recommended": "506",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40074",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40074.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.