CVE-2025-40183

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40183", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.177Z", "datePublished": "2025-11-12T21:56:27.429Z", "dateUpdated": "2026-10-15T22:02:39.850Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:23.502Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}\n\nCilium has a BPF egress gateway feature which forces outgoing K8s Pod\ntraffic to pass through dedicated egress gateways which then SNAT the\ntraffic in order to interact with stable IPs outside the cluster.\n\nThe traffic is directed to the gateway via vxlan tunnel in collect md\nmode. A recent BPF change utilized the bpf_redirect_neigh() helper to\nforward packets after the arrival and decap on vxlan, which turned out\nover time that the kmalloc-256 slab usage in kernel was ever-increasing.\n\nThe issue was that vxlan allocates the metadata_dst object and attaches\nit through a fake dst entry to the skb. The latter was never released\nthough given bpf_redirect_neigh() was merely setting the new dst entry\nvia skb_dst_set() without dropping an existing one first."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The leak is in the net/core/filter.c datapath and is driven entirely by received packets \u2014 unauthenticated VXLAN/UDP frames decapsulated by a collect-md tunnel attach the metadata_dst that is subsequently orphaned by bpf_redirect_neigh(). A remote sender anywhere on the network can drive the leak at will.\nAC:L - Every packet traversing the tc-BPF redirect path leaks deterministically \u2014 no race, no memory-layout dependence, no timing window. Cilium's egress-gateway configuration that exposes this is a mainstream, widely deployed Kubernetes setup, and once present the trigger is 100% reliable.\nPR:N - VXLAN collect-md decapsulation performs no authentication of the encapsulated traffic, so the attacker needs no credentials or account on the target \u2014 merely the ability to send packets that transit the gateway. The privileged operation (loading the tc BPF program) is performed by the administrator, not the attacker.\nUI:N - The leak occurs entirely within kernel packet processing on the receive path; no local user or administrator has to take any action for the attacker's packets to be processed.\nS:U - The orphaned dst objects and pinned netdev references stay within the kernel's own resource domain on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The metadata_dst is simply never freed \u2014 it is not reused, re-read, or exposed to the attacker, and no out-of-bounds or uninitialized memory is accessed. No information is disclosed.\nI:N - There is no memory corruption, overwrite, or type confusion; the only effect is that a reference is never released, so no kernel or user data is modified.\nA:H - The leak is unbounded and attacker-paced \u2014 256 bytes of kmalloc-256 per redirected packet with no upper limit, so sustained traffic exhausts kernel memory and drives the node into OOM/panic. On paths carrying a real route dst, the leaked reference also pins net_devices, hanging network-namespace teardown indefinitely."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/filter.c"], "versions": [{"version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "3fba965a9aac0fa3cbd8138436a37af9ab466d79", "status": "affected", "versionType": "git"}, {"version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "057764172fcc6ee2ccb6c41351a55a9f054dc8fd", "status": "affected", "versionType": "git"}, {"version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "2e67c2037382abb56497bb9d7b7e10be04eb5598", "status": "affected", "versionType": "git"}, {"version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "b6bfe44b6dbb14a31d86c475cdc9c7689534fb09", "status": "affected", "versionType": "git"}, {"version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "f36a305d30f557306d87c787ddffe094ac5dac89", "status": "affected", "versionType": "git"}, {"version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "7404ce888a45eb7da0508b7cbbe6f2e95302eeb8", "status": "affected", "versionType": "git"}, {"version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "23f3770e1a53e6c7a553135011f547209e141e72", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/filter.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.195", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.157", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.113", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.54", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.4", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.246"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.195"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.17.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3fba965a9aac0fa3cbd8138436a37af9ab466d79"}, {"url": "https://git.kernel.org/stable/c/057764172fcc6ee2ccb6c41351a55a9f054dc8fd"}, {"url": "https://git.kernel.org/stable/c/2e67c2037382abb56497bb9d7b7e10be04eb5598"}, {"url": "https://git.kernel.org/stable/c/b6bfe44b6dbb14a31d86c475cdc9c7689534fb09"}, {"url": "https://git.kernel.org/stable/c/f36a305d30f557306d87c787ddffe094ac5dac89"}, {"url": "https://git.kernel.org/stable/c/7404ce888a45eb7da0508b7cbbe6f2e95302eeb8"}, {"url": "https://git.kernel.org/stable/c/23f3770e1a53e6c7a553135011f547209e141e72"}], "title": "bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40183", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:43.679518Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:39.850Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40183", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:43.679518Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:57:44.291Z"}}], "cna": {"title": "bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The leak is in the net/core/filter.c datapath and is driven entirely by received packets \u2014 unauthenticated VXLAN/UDP frames decapsulated by a collect-md tunnel attach the metadata_dst that is subsequently orphaned by bpf_redirect_neigh(). A remote sender anywhere on the network can drive the leak at will.\nAC:L - Every packet traversing the tc-BPF redirect path leaks deterministically \u2014 no race, no memory-layout dependence, no timing window. Cilium's egress-gateway configuration that exposes this is a mainstream, widely deployed Kubernetes setup, and once present the trigger is 100% reliable.\nPR:N - VXLAN collect-md decapsulation performs no authentication of the encapsulated traffic, so the attacker needs no credentials or account on the target \u2014 merely the ability to send packets that transit the gateway. The privileged operation (loading the tc BPF program) is performed by the administrator, not the attacker.\nUI:N - The leak occurs entirely within kernel packet processing on the receive path; no local user or administrator has to take any action for the attacker's packets to be processed.\nS:U - The orphaned dst objects and pinned netdev references stay within the kernel's own resource domain on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The metadata_dst is simply never freed \u2014 it is not reused, re-read, or exposed to the attacker, and no out-of-bounds or uninitialized memory is accessed. No information is disclosed.\nI:N - There is no memory corruption, overwrite, or type confusion; the only effect is that a reference is never released, so no kernel or user data is modified.\nA:H - The leak is unbounded and attacker-paced \u2014 256 bytes of kmalloc-256 per redirected packet with no upper limit, so sustained traffic exhausts kernel memory and drives the node into OOM/panic. On paths carrying a real route dst, the leaked reference also pins net_devices, hanging network-namespace teardown indefinitely."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "3fba965a9aac0fa3cbd8138436a37af9ab466d79", "versionType": "git"}, {"status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "057764172fcc6ee2ccb6c41351a55a9f054dc8fd", "versionType": "git"}, {"status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "2e67c2037382abb56497bb9d7b7e10be04eb5598", "versionType": "git"}, {"status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "b6bfe44b6dbb14a31d86c475cdc9c7689534fb09", "versionType": "git"}, {"status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "f36a305d30f557306d87c787ddffe094ac5dac89", "versionType": "git"}, {"status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "7404ce888a45eb7da0508b7cbbe6f2e95302eeb8", "versionType": "git"}, {"status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "lessThan": "23f3770e1a53e6c7a553135011f547209e141e72", "versionType": "git"}], "programFiles": ["net/core/filter.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"status": "unaffected", "version": "0", "lessThan": "5.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.246", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.195", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.157", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.113", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.54", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.4", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/filter.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3fba965a9aac0fa3cbd8138436a37af9ab466d79"}, {"url": "https://git.kernel.org/stable/c/057764172fcc6ee2ccb6c41351a55a9f054dc8fd"}, {"url": "https://git.kernel.org/stable/c/2e67c2037382abb56497bb9d7b7e10be04eb5598"}, {"url": "https://git.kernel.org/stable/c/b6bfe44b6dbb14a31d86c475cdc9c7689534fb09"}, {"url": "https://git.kernel.org/stable/c/f36a305d30f557306d87c787ddffe094ac5dac89"}, {"url": "https://git.kernel.org/stable/c/7404ce888a45eb7da0508b7cbbe6f2e95302eeb8"}, {"url": "https://git.kernel.org/stable/c/23f3770e1a53e6c7a553135011f547209e141e72"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}\n\nCilium has a BPF egress gateway feature which forces outgoing K8s Pod\ntraffic to pass through dedicated egress gateways which then SNAT the\ntraffic in order to interact with stable IPs outside the cluster.\n\nThe traffic is directed to the gateway via vxlan tunnel in collect md\nmode. A recent BPF change utilized the bpf_redirect_neigh() helper to\nforward packets after the arrival and decap on vxlan, which turned out\nover time that the kmalloc-256 slab usage in kernel was ever-increasing.\n\nThe issue was that vxlan allocates the metadata_dst object and attaches\nit through a fake dst entry to the skb. The latter was never released\nthough given bpf_redirect_neigh() was merely setting the new dst entry\nvia skb_dst_set() without dropping an existing one first."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.246", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.195", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.157", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.113", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.54", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.4", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "5.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:23.502Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40183", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:39.850Z", "dateReserved": "2025-04-16T07:20:57.177Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-11-12T21:56:27.429Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/filter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3fba965a9aac0fa3cbd8138436a37af9ab466d79", "status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "versionType": "git"}, {"lessThan": "057764172fcc6ee2ccb6c41351a55a9f054dc8fd", "status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "versionType": "git"}, {"lessThan": "2e67c2037382abb56497bb9d7b7e10be04eb5598", "status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "versionType": "git"}, {"lessThan": "b6bfe44b6dbb14a31d86c475cdc9c7689534fb09", "status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "versionType": "git"}, {"lessThan": "f36a305d30f557306d87c787ddffe094ac5dac89", "status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "versionType": "git"}, {"lessThan": "7404ce888a45eb7da0508b7cbbe6f2e95302eeb8", "status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "versionType": "git"}, {"lessThan": "23f3770e1a53e6c7a553135011f547209e141e72", "status": "affected", "version": "b4ab31414970a7a03a5d55d75083f2c101a30592", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/filter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.246", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.195", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.157", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.113", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.54", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}\n\nCilium has a BPF egress gateway feature which forces outgoing K8s Pod\ntraffic to pass through dedicated egress gateways which then SNAT the\ntraffic in order to interact with stable IPs outside the cluster.\n\nThe traffic is directed to the gateway via vxlan tunnel in collect md\nmode. A recent BPF change utilized the bpf_redirect_neigh() helper to\nforward packets after the arrival and decap on vxlan, which turned out\nover time that the kmalloc-256 slab usage in kernel was ever-increasing.\n\nThe issue was that vxlan allocates the metadata_dst object and attaches\nit through a fake dst entry to the skb. The latter was never released\nthough given bpf_redirect_neigh() was merely setting the new dst entry\nvia skb_dst_set() without dropping an existing one first."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: Correcci\u00f3n de fuga de metadata_dst __bpf_redirect_neigh_v{4,6}\n\nCilium tiene una caracter\u00edstica de puerta de enlace de salida BPF que fuerza el tr\u00e1fico saliente de los Pods de K8s a pasar a trav\u00e9s de puertas de enlace de salida dedicadas que luego realizan SNAT al tr\u00e1fico para interactuar con IPs estables fuera del cl\u00faster.\n\nEl tr\u00e1fico se dirige a la puerta de enlace a trav\u00e9s de un t\u00fanel vxlan en modo collect md. Un cambio reciente en BPF utiliz\u00f3 el ayudante bpf_redirect_neigh() para reenviar paquetes despu\u00e9s de la llegada y desencapsulaci\u00f3n en vxlan, lo que con el tiempo revel\u00f3 que el uso de slab kmalloc-256 en el kernel estaba en constante aumento.\n\nEl problema era que vxlan asigna el objeto metadata_dst y lo adjunta a trav\u00e9s de una entrada dst falsa al skb. Sin embargo, este \u00faltimo nunca se liber\u00f3, dado que bpf_redirect_neigh() simplemente estaba configurando la nueva entrada dst a trav\u00e9s de skb_dst_set() sin eliminar primero una existente."}], "id": "CVE-2025-40183", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40183", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:57:43.679518Z", "version": "2.0.3"}}]}, "published": "2025-11-12T22:15:45.080", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/057764172fcc6ee2ccb6c41351a55a9f054dc8fd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/23f3770e1a53e6c7a553135011f547209e141e72"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e67c2037382abb56497bb9d7b7e10be04eb5598"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3fba965a9aac0fa3cbd8138436a37af9ab466d79"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7404ce888a45eb7da0508b7cbbe6f2e95302eeb8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6bfe44b6dbb14a31d86c475cdc9c7689534fb09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f36a305d30f557306d87c787ddffe094ac5dac89"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}", "id": "2414709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414709"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}\nCilium has a BPF egress gateway feature which forces outgoing K8s Pod\ntraffic to pass through dedicated egress gateways which then SNAT the\ntraffic in order to interact with stable IPs outside the cluster.\nThe traffic is directed to the gateway via vxlan tunnel in collect md\nmode. A recent BPF change utilized the bpf_redirect_neigh() helper to\nforward packets after the arrival and decap on vxlan, which turned out\nover time that the kmalloc-256 slab usage in kernel was ever-increasing.\nThe issue was that vxlan allocates the metadata_dst object and attaches\nit through a fake dst entry to the skb. The latter was never released\nthough given bpf_redirect_neigh() was merely setting the new dst entry\nvia skb_dst_set() without dropping an existing one first."], "name": "CVE-2025-40183", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40183\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40183\nhttps://lore.kernel.org/linux-cve-announce/2025111243-CVE-2025-40183-fb2f@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-11-13T09:52:21.283043+00:00", "updated": "2025-11-13T09:52:21.283068+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}