CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps()
In the Linux kernel, the following vulnerability has been resolved:
net: use dstdevrcu() in sksetupcaps()
Use RCU to protect accesses to dst->dev from sksetupcaps() and skdstgsomaxsize().
Also use dstdevrcu() in ip6dstmtumaybeforward(), and ipdstmtumaybeforward().
ip4dsthoplimit() can use dstdevnetrcu().
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: use dstdevrcu() in sksetupcaps()
Use RCU to protect accesses to dst-dev from sksetupcaps() and skdstgsomaxsize().
Also use dstdevrcu() in ip6dstmtumaybeforward(), and ipdstmtumaybeforward().
ip4dsthoplimit() can use dstdevnetrcu().
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40170?
CVE-2025-40170 has a high severity level due to its potential impact on system stability and security.
How do I fix CVE-2025-40170?
To fix CVE-2025-40170, update the Linux kernel to the latest version that contains the patch for this vulnerability.
What systems are affected by CVE-2025-40170?
CVE-2025-40170 affects the Linux kernel across various distributions that utilize the impacted versions.
What are the risks associated with CVE-2025-40170?
The risks associated with CVE-2025-40170 include possible system crashes and exploitation leading to potential unauthorized access.
Is there a workaround for CVE-2025-40170?
There are no recommended workarounds for CVE-2025-40170; applying the kernel update is the best course of action.