CVE-2025-40091: ixgbe: fix too early devlink_free() in ixgbe_remove()
In the Linux kernel, the following vulnerability has been resolved:
ixgbe: fix too early devlinkfree() in ixgberemove()
Since ixgbeadapter is embedded in devlink, calling devlinkfree() prematurely in the ixgberemove() path can lead to UAF. Move devlinkfree() to the end.
KASAN report:
BUG: KASAN: use-after-free in ixgberesetinterruptcapability+0x140/0x180 [ixgbe] Read of size 8 at addr ffff0000adf813e0 by task bash/2095 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) [...] Call trace: showstack+0x30/0x90 (C) dumpstacklvl+0x9c/0xd0 printaddressdescription.constprop.0+0x90/0x310 printreport+0x104/0x1f0 kasanreport+0x88/0x180 asanreportload8noabort+0x20/0x30 ixgberesetinterruptcapability+0x140/0x180 [ixgbe] ixgbeclearinterruptscheme+0xf8/0x130 [ixgbe] ixgberemove+0x2d0/0x8c0 [ixgbe] pcideviceremove+0xa0/0x220 deviceremove+0xb8/0x170 devicereleasedriverinternal+0x318/0x490 devicedriverdetach+0x40/0x68 unbindstore+0xec/0x118 drvattrstore+0x64/0xb8 sysfskfwrite+0xcc/0x138 kernfsfopwriteiter+0x294/0x440 newsyncwrite+0x1fc/0x588 vfswrite+0x480/0x6a0 ksyswrite+0xf0/0x1e0 arm64syswrite+0x70/0xc0 invokesyscall.constprop.0+0xcc/0x280 el0svccommon.constprop.0+0xa8/0x248 doel0svc+0x44/0x68 el0svc+0x54/0x160 el0t64synchandler+0xa0/0xe8 el0t64sync+0x1b0/0x1b8
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-oem-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1011.11 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1006.7~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.17.0-14.14 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.17.0-1006.7 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.17.0-14.14.1 - Compensating control
In the ixgbe_remove() path, move devlink_free() to the end so it is called only after ixgbe_clear_interrupt_scheme() and other removal operations, preventing use-after-free of the embedded ixgbe_adapter.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40091?
CVE-2025-40091 is classified as a medium-severity vulnerability affecting the Linux kernel.
What systems are affected by CVE-2025-40091?
CVE-2025-40091 affects the Linux kernel version 6.17.0-rc2-tnguy.net-queue and Intel IXGBE networks.
How do I fix CVE-2025-40091?
To fix CVE-2025-40091, update to the latest version of the Linux kernel that addresses this vulnerability.
What is the impact of CVE-2025-40091 on system security?
The improper handling of the ixgbe_adapter can lead to a use-after-free vulnerability, potentially impacting system stability and security.
When was CVE-2025-40091 published?
CVE-2025-40091 was officially published as a security issue in the Linux kernel.