BaseFortify

Publication date: 2025-11-12

Last updated on: 2025-11-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the returned value of smc_clc_prfx_match() is not used in the caller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-12

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-40168

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper use of certain functions in the smc_clc_prfx_match() function. Specifically, smc_clc_prfx_match() uses sk_dst_get(sk)->dev, which can trigger a use-after-free (UAF) condition because it is called from smc_listen_work() without proper synchronization (not under RCU nor RTNL). The fix involves using __sk_dst_get() and dst_dev_rcu() to safely access the device pointer and avoid the UAF.

Impact Analysis

This vulnerability can lead to a use-after-free condition in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the kernel memory corruption.

Hi! I’m here to help you understand CVE-2025-40168. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70