CVE-2025-40158: ipv6: use RCU in ip6_output()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: use RCU in ip6output()
Use RCU in ip6output() in order to use dstdevrcu() to prevent possible UAF.
We can remove rcureadlock()/rcureadunlock() pairs from ip6finishoutput2().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40158?
CVE-2025-40158 is considered a medium severity vulnerability due to potential user-after-free (UAF) risks in the Linux kernel's ipv6 output handling.
How do I fix CVE-2025-40158?
To fix CVE-2025-40158, update your Linux kernel to the latest version where the vulnerability has been resolved.
What components are affected by CVE-2025-40158?
CVE-2025-40158 affects the Linux kernel specifically in the handling of IPv6 output.
Is CVE-2025-40158 publicly known?
Yes, CVE-2025-40158 is publicly documented and has been addressed in recent security patches.
What types of systems are impacted by CVE-2025-40158?
CVE-2025-40158 impacts systems running versions of the Linux kernel that manage IPv6 functionalities.