CVE-2025-40075

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40075", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.160Z", "datePublished": "2025-10-28T11:48:41.791Z", "dateUpdated": "2026-10-30T12:22:48.219Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:22:48.219Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_metrics: use dst_dev_net_rcu()\n\nReplace three dst_dev() with a lockdep enabled helper."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The three fixed call sites sit in the core TCP metrics cache, reached from `tcp_conn_request()` on an inbound SYN, from `tcp_finish_connect()`, from the TIME-WAIT/LAST-ACK teardown path, and from TCP Fast Open \u2014 all driven purely by packets from a remote peer. No local access is needed to reach the vulnerable code.\nAC:H - The stale `dst->dev` window only exists while `dst_dev_put()` is concurrently swapping the device to the blackhole netdev during a route removal or NETDEV_DOWN/UNREGISTER event, which a remote attacker cannot induce or time. The attacker controls only the TCP-connection side of the race.\nPR:N - `tcp_peer_is_proven()` is invoked from `tcp_conn_request()` while processing an unauthenticated SYN, before any application-level credentials exist, and the other paths only require establishing or closing a normal TCP connection. No kernel privilege check or capability gate exists anywhere along the path.\nUI:N - The code runs entirely from softirq/socket context on packet receive and connection teardown; no local user or administrator action is required to trigger it.\nS:U - The unprotected dereference and its consequences are confined to the kernel's own memory and the network stack \u2014 the same security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - A use-after-free read of a released `struct net_device` yields a `struct net` pointer taken from reclaimed memory, which is then used to compute hashes and index the per-namespace metrics cache; attacker-groomed heap contents can be interpreted as kernel structures, enabling disclosure of kernel memory.\nI:H - The bogus `struct net` derived from the freed device is stored into `tm->tcpm_net` and drives `tcpm_new()`/`tcpm_suck_dst()` writes, so freed or attacker-controlled memory is treated as a live namespace object \u2014 a UAF of this class is leverageable for controlled kernel writes and control-flow hijack.\nA:H - Dereferencing a freed `net_device` through `dev_net_rcu()` and then using the resulting garbage `struct net` pointer for `net_hash_mix()` and cache lookups leads to an oops or panic, taking down the whole system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_metrics.c"], "versions": [{"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "23261817e955ebeb91d7c5c667d09fa415eb88b4", "status": "affected", "versionType": "git"}, {"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "7012bea5622396b37566fbdc059f7c6a6c279d74", "status": "affected", "versionType": "git"}, {"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "4b89397807eb04986427c4786d065e9442834ad4", "status": "affected", "versionType": "git"}, {"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "07613a95326ebad2d1b88d883cd72546025a4f3e", "status": "affected", "versionType": "git"}, {"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "50c127a69cd6285300931853b352a1918cfa180f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_metrics.c"], "versions": [{"version": "4.13", "status": "affected"}, {"version": "0", "lessThan": "4.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.63", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.12.63"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/23261817e955ebeb91d7c5c667d09fa415eb88b4"}, {"url": "https://git.kernel.org/stable/c/7012bea5622396b37566fbdc059f7c6a6c279d74"}, {"url": "https://git.kernel.org/stable/c/4b89397807eb04986427c4786d065e9442834ad4"}, {"url": "https://git.kernel.org/stable/c/07613a95326ebad2d1b88d883cd72546025a4f3e"}, {"url": "https://git.kernel.org/stable/c/50c127a69cd6285300931853b352a1918cfa180f"}], "title": "tcp_metrics: use dst_dev_net_rcu()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40075", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:41.266469Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:37.357Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40075", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:41.266469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:56:41.872Z"}}], "cna": {"title": "tcp_metrics: use dst_dev_net_rcu()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The three fixed call sites sit in the core TCP metrics cache, reached from `tcp_conn_request()` on an inbound SYN, from `tcp_finish_connect()`, from the TIME-WAIT/LAST-ACK teardown path, and from TCP Fast Open \u2014 all driven purely by packets from a remote peer. No local access is needed to reach the vulnerable code.\nAC:H - The stale `dst->dev` window only exists while `dst_dev_put()` is concurrently swapping the device to the blackhole netdev during a route removal or NETDEV_DOWN/UNREGISTER event, which a remote attacker cannot induce or time. The attacker controls only the TCP-connection side of the race.\nPR:N - `tcp_peer_is_proven()` is invoked from `tcp_conn_request()` while processing an unauthenticated SYN, before any application-level credentials exist, and the other paths only require establishing or closing a normal TCP connection. No kernel privilege check or capability gate exists anywhere along the path.\nUI:N - The code runs entirely from softirq/socket context on packet receive and connection teardown; no local user or administrator action is required to trigger it.\nS:U - The unprotected dereference and its consequences are confined to the kernel's own memory and the network stack \u2014 the same security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - A use-after-free read of a released `struct net_device` yields a `struct net` pointer taken from reclaimed memory, which is then used to compute hashes and index the per-namespace metrics cache; attacker-groomed heap contents can be interpreted as kernel structures, enabling disclosure of kernel memory.\nI:H - The bogus `struct net` derived from the freed device is stored into `tm->tcpm_net` and drives `tcpm_new()`/`tcpm_suck_dst()` writes, so freed or attacker-controlled memory is treated as a live namespace object \u2014 a UAF of this class is leverageable for controlled kernel writes and control-flow hijack.\nA:H - Dereferencing a freed `net_device` through `dev_net_rcu()` and then using the resulting garbage `struct net` pointer for `net_hash_mix()` and cache lookups leads to an oops or panic, taking down the whole system."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "23261817e955ebeb91d7c5c667d09fa415eb88b4", "versionType": "git"}, {"status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "7012bea5622396b37566fbdc059f7c6a6c279d74", "versionType": "git"}, {"status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "4b89397807eb04986427c4786d065e9442834ad4", "versionType": "git"}, {"status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "07613a95326ebad2d1b88d883cd72546025a4f3e", "versionType": "git"}, {"status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "lessThan": "50c127a69cd6285300931853b352a1918cfa180f", "versionType": "git"}], "programFiles": ["net/ipv4/tcp_metrics.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"status": "unaffected", "version": "0", "lessThan": "4.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.63", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.3", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv4/tcp_metrics.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/23261817e955ebeb91d7c5c667d09fa415eb88b4"}, {"url": "https://git.kernel.org/stable/c/7012bea5622396b37566fbdc059f7c6a6c279d74"}, {"url": "https://git.kernel.org/stable/c/4b89397807eb04986427c4786d065e9442834ad4"}, {"url": "https://git.kernel.org/stable/c/07613a95326ebad2d1b88d883cd72546025a4f3e"}, {"url": "https://git.kernel.org/stable/c/50c127a69cd6285300931853b352a1918cfa180f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_metrics: use dst_dev_net_rcu()\n\nReplace three dst_dev() with a lockdep enabled helper."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.63", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.3", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "4.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:22:48.219Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40075", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:22:48.219Z", "dateReserved": "2025-04-16T07:20:57.160Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-28T11:48:41.791Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/tcp_metrics.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "23261817e955ebeb91d7c5c667d09fa415eb88b4", "status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "versionType": "git"}, {"lessThan": "7012bea5622396b37566fbdc059f7c6a6c279d74", "status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "versionType": "git"}, {"lessThan": "4b89397807eb04986427c4786d065e9442834ad4", "status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "versionType": "git"}, {"lessThan": "07613a95326ebad2d1b88d883cd72546025a4f3e", "status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "versionType": "git"}, {"lessThan": "50c127a69cd6285300931853b352a1918cfa180f", "status": "affected", "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/tcp_metrics.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"lessThan": "4.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.63", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_metrics: use dst_dev_net_rcu()\n\nReplace three dst_dev() with a lockdep enabled helper."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntcp_metrics: usar dst_dev_net_rcu()\n\nReemplazar tres dst_dev() con un ayudante habilitado para lockdep."}], "id": "CVE-2025-40075", "lastModified": "2026-10-30T13:18:13.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40075", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:56:41.266469Z", "version": "2.0.3"}}]}, "published": "2025-10-28T12:15:42.053", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07613a95326ebad2d1b88d883cd72546025a4f3e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/23261817e955ebeb91d7c5c667d09fa415eb88b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4b89397807eb04986427c4786d065e9442834ad4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/50c127a69cd6285300931853b352a1918cfa180f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7012bea5622396b37566fbdc059f7c6a6c279d74"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: tcp_metrics: use dst_dev_net_rcu()", "id": "2406780", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406780"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40075", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40075\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40075\nhttps://lore.kernel.org/linux-cve-announce/2025102819-CVE-2025-40075-770f@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-10-29T10:58:07.574966+00:00", "updated": "2025-10-29T10:58:07.574991+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}