UBUNTU-CVE-2025-40091: Use After Free

Q: Which systems are exposed to this issue?

The issue affects the listed Ubuntu Linux kernel packages when the ixgbe network driver is in use. It occurs during removal or unbinding of an ixgbe PCI device or driver.

Q: What is required to trigger the use-after-free?

The triggering path shown involves writing to the driver's sysfs unbind interface, which detaches the ixgbe driver from a PCI device. The vulnerable sequence occurs when ixgbe_remove() frees devlink before later cleanup accesses the embedded ixgbe_adapter.

Q: Is there a workaround if an updated kernel cannot be deployed immediately?

Avoid manually unbinding or removing devices using the ixgbe driver until the kernel can be updated. This reduces exposure to the affected ixgbe_remove() cleanup path.

Q: How can administrators identify potentially affected hosts?

Check whether the host runs one of the listed Ubuntu kernel package variants and has Intel hardware using the ixgbe driver. Kernel logs from a triggered condition may contain a KASAN use-after-free report referencing ixgbe_reset_interrupt_capability, ixgbe_clear_interrupt_scheme, and ixgbe_remove.

Published Oct 30, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix too early devlinkfree() in ixgberemove() Since ixgbeadapter is embedded in devlink, calling devlinkfree() prematurely in the ixgberemove() path can lead to UAF. Move devlinkfree() to the end. KASAN report: BUG: KASAN: use-after-free in ixgberesetinterruptcapability+0x140/0x180 [ixgbe] Read of size 8 at addr ffff0000adf813e0 by task bash/2095 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) [...] Call trace: showstack+0x30/0x90 (C) dumpstacklvl+0x9c/0xd0 printaddressdescription.constprop.0+0x90/0x310 printreport+0x104/0x1f0 kasanreport+0x88/0x180 asanreportload8noabort+0x20/0x30 ixgberesetinterruptcapability+0x140/0x180 [ixgbe] ixgbeclearinterruptscheme+0xf8/0x130 [ixgbe] ixgberemove+0x2d0/0x8c0 [ixgbe] pcideviceremove+0xa0/0x220 deviceremove+0xb8/0x170 devicereleasedriverinternal+0x318/0x490 devicedriverdetach+0x40/0x68 unbindstore+0xec/0x118 drvattrstore+0x64/0xb8 sysfskfwrite+0xcc/0x138 kernfsfopwriteiter+0x294/0x440 newsyncwrite+0x1fc/0x588 vfswrite+0x480/0x6a0 ksyswrite+0xf0/0x1e0 arm64syswrite+0x70/0xc0 invokesyscall.constprop.0+0xcc/0x280 el0svccommon.constprop.0+0xa8/0x248 doel0svc+0x44/0x68 el0svc+0x54/0x160 el0t64synchandler+0xa0/0xe8 el0t64sync+0x1b0/0x1b8

Affected Software

102 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.17<6.17.0-1007.7~24.04.1

6.17.0-1007.7~24.04.1

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.17<6.17.0-1008.8~24.04.1

6.17.0-1008.8~24.04.1

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1008.8

6.17.0-1008.8

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.17<6.17.0-1011.11

6.17.0-1011.11

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.17<6.17.0-1007.7~24.04.1

6.17.0-1007.7~24.04.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-realtime-6.17<6.17.0-1006.7~24.04.1

6.17.0-1006.7~24.04.1

ubuntu/linux<6.17.0-14.14

6.17.0-14.14

ubuntu/linux-aws<6.17.0-1007.7

6.17.0-1007.7

ubuntu/linux-azure<6.17.0-1008.8

6.17.0-1008.8

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<6.17.0-1007.7

6.17.0-1007.7

ubuntu/linux-oracle<6.17.0-1007.7

6.17.0-1007.7

ubuntu/linux-raspi<6.17.0-1008.8

6.17.0-1008.8

ubuntu/linux-realtime<6.17.0-1006.7

6.17.0-1006.7

ubuntu/linux-riscv<6.17.0-14.14.1

6.17.0-14.14.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8~24.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.11
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7~24.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1006.7~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.17.0-14.14
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.17.0-1007.7
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.17.0-1008.8
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.17.0-1006.7
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.17.0-14.14.1
Configuration
Move devlink_free() to the end of the ixgbe_remove() path to prevent use-after-free caused by ixgbe_adapter being embedded in devlink.
Linux kernel ixgbe driver devlink_free() placement in ixgbe_remove() = end of ixgbe_remove()

Event History

Oct 30, 2025

CVE Published

via OSV·10:15 AM

Data Sourced

via OSV·10:15 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The issue affects the listed Ubuntu Linux kernel packages when the ixgbe network driver is in use. It occurs during removal or unbinding of an ixgbe PCI device or driver.

What is required to trigger the use-after-free?

The triggering path shown involves writing to the driver's sysfs unbind interface, which detaches the ixgbe driver from a PCI device. The vulnerable sequence occurs when ixgbe_remove() frees devlink before later cleanup accesses the embedded ixgbe_adapter.

Is there a workaround if an updated kernel cannot be deployed immediately?

Avoid manually unbinding or removing devices using the ixgbe driver until the kernel can be updated. This reduces exposure to the affected ixgbe_remove() cleanup path.

How can administrators identify potentially affected hosts?

Check whether the host runs one of the listed Ubuntu kernel package variants and has Intel hardware using the ixgbe driver. Kernel logs from a triggered condition may contain a KASAN use-after-free report referencing ixgbe_reset_interrupt_capability, ixgbe_clear_interrupt_scheme, and ixgbe_remove.

UBUNTU-CVE-2025-40091: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the use-after-free?

Is there a workaround if an updated kernel cannot be deployed immediately?

How can administrators identify potentially affected hosts?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the use-after-free?

Is there a workaround if an updated kernel cannot be deployed immediately?

How can administrators identify potentially affected hosts?