In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path,… (CVE-2025-40018)
Published: 2025-12-02 Updated: 2026-03-25 Reference: CVE-2025-40018 2026-03-25 Update: Added patch versions for Ubuntu nodes with GKE. 2025-12-11 Update: Added patch versions and a severity rating for GDC (VMware). GKE Updated: 2026-03-25 Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Unconfined profile or allow CAP_NET_ADMIN . Clusters using GKE Sandbox aren't impacted. What should I do? 2026-03-25 Update : The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later: 1.35.1-gke.1396000 1.34.4-gke.1047000 1.33.8-gke.1026000 1.32.12-gke.1026000 1.31.14-gke.1336000 1.30.14-gke.1991000 The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later: 1.32.9-gke.1330000 1.29.15-gke.2236000 1.30.14-gke.1525000 1.31.13-gke.1231000 1.34.1-gke.2541000 1.28.15-gke.2966000 1.33.5-gke.1350000 You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel . High GDC (VMware) Updated: 2025-12-11 Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 What should I do? The following versions of GDC (VMware) are updated with code to fix this vulnerability. Upgrade your GDC (VMware) clusters to the following versions or later: 1.31.1100-gke.40 Note: Patch versions and a severity assessment for GDC software for VMware are in progress. We'll update this bulletin with that information when it's available. High GKE on AWS Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 What should I do? Note: Patch versions and a severity assessment for GKE on AWS are in progress. We'll update this bulletin with that information when it's available. Pending GKE on Azure Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 What should I do? Note: Patch versions and a severity assessment for GKE on Azure are in progress. We'll update this bulletin with that information when it's available. Pending GDC (bare metal) Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 What should I do? There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. None
AI Analysis
Technical Summary
CVE-2025-40018 addresses a use-after-free vulnerability in the Linux kernel's ip_vs_ftp module during network namespace (netns) cleanup. The issue arises because __ip_vs_ftp_exit() may unregister ip_vs_ftp before all connections with valid cp->app pointers are flushed, causing use-after-free conditions. The patch adds a global 'exiting_module' flag to defer unregistering during netns cleanup until all connections are flushed, preventing premature unregistering and memory corruption.
Potential Impact
Successful exploitation could lead to use-after-free conditions, resulting in potential kernel memory corruption with high impact on confidentiality, integrity, and availability of the system. This could allow an attacker with local privileges to cause system crashes or execute arbitrary code within the kernel context.
Mitigation Recommendations
A fix is available that introduces a global flag to defer ip_vs_ftp unregistering during network namespace cleanup until all connections are flushed. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path,… (CVE-2025-40018)
Description
Published: 2025-12-02 Updated: 2026-03-25 Reference: CVE-2025-40018 2026-03-25 Update: Added patch versions for Ubuntu nodes with GKE. 2025-12-11 Update: Added patch versions and a severity rating for GDC (VMware). GKE Updated: 2026-03-25 Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Unconfined profile or allow CAP_NET_ADMIN . Clusters using GKE Sandbox aren't impacted. What should I do? 2026-03-25 Update : The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later: 1.35.1-gke.1396000 1.34.4-gke.1047000 1.33.8-gke.1026000 1.32.12-gke.1026000 1.31.14-gke.1336000 1.30.14-gke.1991000 The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later: 1.32.9-gke.1330000 1.29.15-gke.2236000 1.30.14-gke.1525000 1.31.13-gke.1231000 1.34.1-gke.2541000 1.28.15-gke.2966000 1.33.5-gke.1350000 You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel . High GDC (VMware) Updated: 2025-12-11 Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 What should I do? The following versions of GDC (VMware) are updated with code to fix this vulnerability. Upgrade your GDC (VMware) clusters to the following versions or later: 1.31.1100-gke.40 Note: Patch versions and a severity assessment for GDC software for VMware are in progress. We'll update this bulletin with that information when it's available. High GKE on AWS Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 What should I do? Note: Patch versions and a severity assessment for GKE on AWS are in progress. We'll update this bulletin with that information when it's available. Pending GKE on Azure Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 What should I do? Note: Patch versions and a severity assessment for GKE on Azure are in progress. We'll update this bulletin with that information when it's available. Pending GDC (bare metal) Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-40018 What should I do? There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. None
CVSS v3.1
Score 7.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-40018 addresses a use-after-free vulnerability in the Linux kernel's ip_vs_ftp module during network namespace (netns) cleanup. The issue arises because __ip_vs_ftp_exit() may unregister ip_vs_ftp before all connections with valid cp->app pointers are flushed, causing use-after-free conditions. The patch adds a global 'exiting_module' flag to defer unregistering during netns cleanup until all connections are flushed, preventing premature unregistering and memory corruption.
Potential Impact
Successful exploitation could lead to use-after-free conditions, resulting in potential kernel memory corruption with high impact on confidentiality, integrity, and availability of the system. This could allow an attacker with local privileges to cause system crashes or execute arbitrary code within the kernel context.
Mitigation Recommendations
A fix is available that introduces a global flag to defer ip_vs_ftp unregistering during network namespace cleanup until all connections are flushed. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-25rg-2wrr-633h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40018"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d79c2644c7f847b80a
Added to database: 07/30/2026, 15:50:47 UTC
Last enriched: 07/30/2026, 15:56:58 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.