The Linux kernel contained a use-after-free vulnerability in fs/proc, where a directory entry (pde) node is removed from the subdirectory red-black tree via rb_erase() but the node is not cleared with RB_CLEAR_NODE(). This omission allows pde_subdir_next() to return a pointer to a freed node, leading to use-after-free access during proc filesystem directory reads. The issue manifests when concurrent operations traverse /proc/pid/net/dev_snmp6/ while network devices (tun3, tun2) are unregistered and removed from the rbtree. The race condition allows the directory iteration to access a freed pde, causing memory corruption and potential kernel compromise. The vulnerability is tracked as CVE-2025-40271 and has a CVSS 3.1 score indicating high severity.

Successful exploitation of this vulnerability can lead to use-after-free memory access in the kernel, which may result in arbitrary code execution, system crashes, or privilege escalation due to kernel memory corruption. The CVSS vector indicates local attack vector with low complexity and no user interaction required, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a kernel vulnerability, remediation typically involves applying an official kernel update that includes the fix to clear the erased node properly. Until a patch is applied, avoid running untrusted code that can trigger concurrent directory traversal and device unregistration operations. Monitor vendor advisories for official fixes.