CVE-2025-40168 — Use After Free in Linux

CWE-416 — Use After Free17 documents8 sources
Severity
5.5MEDIUM
No vector
EPSS
0.0%
top 94.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
LinuxLinux KernelDebian Linux+7 more
Timeline
PublishedNov 12
Latest updateFeb 24

Description

In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the returned value of smc_clc_prfx_match() is not used in the caller.

Affected Packages12 packages

▶Linuxlinux/linux_kernel4.11.0 — 6.17.3
▶Debianlinux/linux_kernel< 6.17.6-1
▶Ubuntulinux/linux_kernel< 6.17.0-14.14

🔴Vulnerability Details

8
OSV
linux-azure vulnerabilities↗2026-02-24
▶
OSV
linux-oem-6.17 vulnerabilities↗2026-02-17
▶
OSV
linux-aws, linux-oracle vulnerabilities↗2026-02-17
▶
OSV
linux-gcp vulnerabilities↗2026-02-12
▶
OSV
linux, linux-raspi, linux-realtime vulnerabilities↗2026-02-12
▶

📋Vendor Advisories

7
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-02-24
▶
Ubuntu
Linux kernel (OEM) vulnerabilities↗2026-02-17
▶
Ubuntu
Linux kernel (GCP) vulnerabilities↗2026-02-12
▶
Ubuntu
Linux kernel vulnerabilities↗2026-02-12
▶
Red Hat
kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match()↗2025-11-12
▶

💬Community

1
Bugzilla
CVE-2025-40168 kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match()↗2025-11-12
▶