Critical severity · published Oct 28, 2025
CVE-2025-40074
ipv4: start using dst_dev_rcu()
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
ipv4: start using dst_dev_rcu()
Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.
Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),
ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 before 864155c164654110f68a17a63bd0339754790d67; 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 before e150f273cd8ed34ebc6d03758aad95c12fc58337; 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 before 684efb2c86c887685f9aa65e1a21b3df6c1f822d; 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 before 923e0734c386984d45de508528a7a7ad91d791cc; 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 before 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8; 4.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40074
git.kernel.org
https://git.kernel.org/stable/c/864155c164654110f68a17a63bd0339754790d67
git.kernel.org
https://git.kernel.org/stable/c/e150f273cd8ed34ebc6d03758aad95c12fc58337
git.kernel.org
https://git.kernel.org/stable/c/684efb2c86c887685f9aa65e1a21b3df6c1f822d
git.kernel.org
https://git.kernel.org/stable/c/923e0734c386984d45de508528a7a7ad91d791cc
git.kernel.org
https://git.kernel.org/stable/c/6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place