CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
In the Linux kernel, the following vulnerability has been resolved:
smc: Use skdstget() and dstdevrcu() in in smcclcprfxset().
smcclcprfxset() is called during connect() and not under RCU nor RTNL.
Using skdstget(sk)->dev could trigger UAF.
Let's use skdstget() and devdstrcu() under rcureadlock() after kernelgetsockname().
Note that the returned value of smcclcprfxset() is not used in the caller.
While at it, we change the 1st arg of smcclcprfxset[46]rcu() not to touch dst there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
ubuntu/linux-aws-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-oem-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1011.11 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1006.7~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.17.0-14.14 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.17.0-1006.7 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.17.0-14.14.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.115-2~deb12u1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40139?
CVE-2025-40139 has a medium severity level due to the potential for use-after-free vulnerabilities.
How do I fix CVE-2025-40139?
To fix CVE-2025-40139, update to the latest version of the Linux kernel that includes the patches addressing this vulnerability.
What software is affected by CVE-2025-40139?
CVE-2025-40139 affects the Linux kernel.
What is the impact of an exploit of CVE-2025-40139?
Exploiting CVE-2025-40139 could lead to a crash or potentially allow an attacker to execute arbitrary code.
Is there a workaround for CVE-2025-40139?
Currently, there are no known workarounds for CVE-2025-40139; applying the patch is recommended.