Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the component responsible for IPsec (XFRM) and IP compression. Under certain conditions, such as during network namespace destruction or high volumes of fragmented traffic, the system may fail to properly clean up internal tunnel states. This can lead to system instability or potentially allow a local user to cause a denial of service or gain unauthorized access to system resources.
Technical details
A vulnerability exists in the Linux kernel XFRM state management where ipcomp fallback tunnels are not deleted until the associated user state is destroyed, rather than when it is deleted. Because references to xfrm_state can be held by skbs in TCP deferred freeing paths or IP reassembly queues, the fallback state can persist in hashtables/lists after netns destruction, triggering warnings in xfrm_state_fini. This is a race condition/resource leak issue where the fix involves explicitly deleting the fallback state (x->tunnel) during the state deletion phase rather than waiting for the final reference drop. The vulnerability affects the XFRM framework and IPcomp implementations in both IPv4 and IPv6. Patches have been released across multiple stable kernel branches to ensure synchronous deletion of tunnel states.
Affected products
- Linux Linux Kernel 2.6.29 to 6.13
Timeline
- 2025-12-04: advisory: CVE-2025-40215 published
- 2026-01-11: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/0da961fa46da1b37ef868d9b603bd202136f8f8e
- https://git.kernel.org/stable/c/1b28a7fae0128fa140a7dccd995182ff6cd1c67b
- https://git.kernel.org/stable/c/4b2c17d0f9be8b58bb30468bc81a4b61c985b04e
- https://git.kernel.org/stable/c/b441cf3f8c4b8576639d20c8eb4aa32917602ecd
- https://git.kernel.org/stable/c/d0e0d1097118461463b76562c7ebaabaa5b90b13
- https://git.kernel.org/stable/c/dc3636912d41770466543623cb76e7b88fdb42c7