{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40074","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.160Z","datePublished":"2025-10-28T11:48:41.202Z","dateUpdated":"2026-08-27T12:39:36.800Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-27T12:39:36.800Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: start using dst_dev_rcu()\n\nChange icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.\n\nChange ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),\nipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu()."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - Every fixed site is on a pure packet-processing path — `icmpv4_xrlim_allow()` runs on inbound ICMP echo requests and on ICMP error generation, `ip_defrag()` runs on inbound IPv4 fragments via `ip_local_deliver()`, the conntrack/IPVS/OVS defrag hooks, and the `ipmr_*` sites forward remote multicast traffic. No local access is required to reach the vulnerable code.\nAC:L - An attacker can flood fragmented IPv4 datagrams and ICMP-error-provoking packets continuously, keeping `ip_defrag()` and `icmpv4_xrlim_allow()` executing on the unprotected `dst->dev` fetch at very high rates, so the window is sampled constantly rather than once; on the common deployments where the dst-device teardown is routine and attacker-influenceable (PPPoE/L2TP session churn on a BRAS, tunnel and virtual-interface teardown in cloud/container hosts, route-exception churn the attacker drives with ICMP redirect and PMTU messages), the race is repeatable at will rather than dependent on a condition the attacker cannot reach.\nPR:N - ICMP echo replies and IPv4 fragment reassembly are handled before any authentication or authorization step exists, and there is no capability check anywhere on the path from packet receive to the unprotected `dst->dev` dereference. Any unauthenticated host that can send IP packets to the target reaches this code.\nUI:N - The vulnerable code executes entirely in softirq context on packet receive and in the ICMP/multicast transmit paths; no local user or administrator has to open, mount, or click anything.\nS:U - The stale dereference and any resulting corruption stay inside the kernel's own memory and the network stack, which is a single security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Reading a freed `struct net_device` yields `dev->flags` and, through `l3mdev_master_ifindex_rcu()`, an rcu-dereferenced walk of the upper-device list and a master ifindex, all taken from reclaimed memory; an attacker who grooms the slab into that allocation gets kernel memory interpreted as device state and used to select fragment-reassembly queues and ICMP peer entries, enabling disclosure of kernel memory.\nI:H - The garbage ifindex derived from the freed device becomes the `vif` key for `ip_find()`, steering fragment reassembly into attacker-chosen queues, and the same freed-object pointer feeds `inet_getpeer_v4()`; a use-after-free of a `net_device` of this class is leverageable via heap spraying into controlled kernel writes and control-flow hijack.\nA:H - Dereferencing a released `net_device` and following its upper-device list pointers into freed memory produces an oops or panic in softirq context, taking down the entire system, and it is triggerable by ordinary remote traffic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/icmp.c","net/ipv4/ip_fragment.c","net/ipv4/ipmr.c","net/ipv4/route.c"],"versions":[{"version":"4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36","lessThan":"684efb2c86c887685f9aa65e1a21b3df6c1f822d","status":"affected","versionType":"git"},{"version":"4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36","lessThan":"923e0734c386984d45de508528a7a7ad91d791cc","status":"affected","versionType":"git"},{"version":"4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36","lessThan":"6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/icmp.c","net/ipv4/ip_fragment.c","net/ipv4/ipmr.c","net/ipv4/route.c"],"versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","status":"unaffected","versionType":"semver"},{"version":"6.12.106","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.3","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.12.106"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.17.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/684efb2c86c887685f9aa65e1a21b3df6c1f822d"},{"url":"https://git.kernel.org/stable/c/923e0734c386984d45de508528a7a7ad91d791cc"},{"url":"https://git.kernel.org/stable/c/6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8"}],"title":"ipv4: start using dst_dev_rcu()","x_generator":{"engine":"bippy-1.2.0"}}}}