CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
In the Linux kernel, the following vulnerability has been resolved:
tls: Use skdstget() and dstdevrcu() in getnetdevforsock().
getnetdevforsock() is called during setsockopt(), so not under RCU.
Using skdstget(sk)->dev could trigger UAF.
Let's use skdstget() and dstdevrcu().
Note that the only ->ndoskgetlowerdev() user is bondskgetlowerdev(), which uses RCU.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40149?
CVE-2025-40149 has been classified with a severity rating that indicates a potential risk of unauthorized access due to a use-after-free condition.
How do I fix CVE-2025-40149?
To fix CVE-2025-40149, users should update their Linux kernel to the latest patched version provided by their distribution.
What systems are affected by CVE-2025-40149?
CVE-2025-40149 affects the Linux kernel, specifically in functions related to socket options.
What are the risks associated with CVE-2025-40149?
The risks associated with CVE-2025-40149 include potential remote code execution and denial of service due to improper handling of socket options.
When was CVE-2025-40149 disclosed?
CVE-2025-40149 was disclosed as part of a security update for the Linux kernel addressing vulnerabilities.