Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem that could lead to system instability or unauthorized access. The issue involves how the kernel handles network routing information, potentially allowing a local user to trigger a system crash or gain elevated privileges. This affects the core operating system's ability to securely manage network traffic and maintain system integrity.
Technical details
A vulnerability exists in the Linux kernel networking stack due to unprotected concurrent access to 'dst->dev' within several functions, including sk_setup_caps(), sk_dst_gso_max_size(), and MTU forwarding routines. The root cause is a lack of RCU (Read-Copy-Update) protection when accessing network device structures from socket setup and routing paths, which can lead to use-after-free or null pointer dereference scenarios if the underlying device is removed or changed. A local attacker with low privileges can exploit this race condition to cause a kernel panic (DoS) or potentially achieve arbitrary code execution. The issue has been resolved by implementing dst_dev_rcu() and proper RCU read-side critical sections in the affected networking components.
Affected products
- Linux Linux Kernel 4.13 to 6.17.3
Timeline
- 2025-08-28: disclosed: Original patch submitted by Eric Dumazet
- 2025-11-12: advisory: CVE-2025-40170 published
- 2026-01-08: patched: Fix committed to stable branches