CVE-2025-40091 — Use After Free in Linux

CWE-416 — Use After Free15 documents6 sources
Severity
6.4MEDIUM
No vector
EPSS
0.0%
top 92.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedOct 30
Latest updateFeb 24

Description

In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix too early devlink_free() in ixgbe_remove() Since ixgbe_adapter is embedded in devlink, calling devlink_free() prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free() to the end. KASAN report: BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] Read of size 8 at addr ffff0000adf813e0 by task bash/2095 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy…

Affected Packages5 packages

▶Linuxlinux/linux_kernel6.16.0 — 6.17.5
▶Debianlinux/linux_kernel< 6.17.6-1
▶Ubuntulinux/linux_kernel< 6.17.0-14.14
▶CVEListV5linux/linuxa0285236ab93fdfdd1008afaa04561d142d6c276 — df445969aa727cd64f3f29dc1f85fb60aca238d1+2
▶debiandebian/linux< linux 6.17.6-1 (forky)

🔴Vulnerability Details

8
OSV
linux-azure vulnerabilities↗2026-02-24
▶
OSV
linux-oem-6.17 vulnerabilities↗2026-02-17
▶
OSV
linux-aws, linux-oracle vulnerabilities↗2026-02-17
▶
OSV
linux-gcp vulnerabilities↗2026-02-12
▶
OSV
linux, linux-raspi, linux-realtime vulnerabilities↗2026-02-12
▶

📋Vendor Advisories

6
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-02-24
▶
Ubuntu
Linux kernel (OEM) vulnerabilities↗2026-02-17
▶
Ubuntu
Linux kernel (GCP) vulnerabilities↗2026-02-12
▶
Ubuntu
Linux kernel vulnerabilities↗2026-02-12
▶
Red Hat
kernel: ixgbe: fix too early devlink_free() in ixgbe_remove()↗2025-10-30
▶