In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to… (CVE-2025-40170)
A high-severity vulnerability in the Linux kernel related to improper use of RCU (Read-Copy-Update) mechanisms in network code has been resolved. The issue involved unsafe access to the destination device pointer (dst->dev) in several kernel functions, including sk_setup_caps(), sk_dst_gso_max_size(), ip6_dst_mtu_maybe_forward(), ip_dst_mtu_maybe_forward(), and ip4_dst_hoplimit(). The fix applies RCU protection to these accesses to prevent potential memory safety issues.
AI Analysis
Technical Summary
CVE-2025-40170 addresses a vulnerability in the Linux kernel's networking stack where accesses to the destination device pointer (dst->dev) were not properly protected by RCU mechanisms in functions such as sk_setup_caps(), sk_dst_gso_max_size(), ip6_dst_mtu_maybe_forward(), ip_dst_mtu_maybe_forward(), and ip4_dst_hoplimit(). This could lead to use-after-free or similar memory corruption issues. The patch introduces the use of dst_dev_rcu() and dst_dev_net_rcu() to ensure safe concurrent access to these pointers.
Potential Impact
The vulnerability allows an attacker with local access (low privileges) to potentially cause confidentiality, integrity, and availability impacts on the affected system due to improper synchronization in kernel network code. This could lead to kernel memory corruption or crashes, impacting system stability and security.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to use RCU protection for accesses to dst->dev in the affected functions. Users should update to a Linux kernel version that includes this patch. Since no specific patched versions are provided, check the vendor or kernel mailing list advisories for the exact fixed versions and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to… (CVE-2025-40170)
Description
A high-severity vulnerability in the Linux kernel related to improper use of RCU (Read-Copy-Update) mechanisms in network code has been resolved. The issue involved unsafe access to the destination device pointer (dst->dev) in several kernel functions, including sk_setup_caps(), sk_dst_gso_max_size(), ip6_dst_mtu_maybe_forward(), ip_dst_mtu_maybe_forward(), and ip4_dst_hoplimit(). The fix applies RCU protection to these accesses to prevent potential memory safety issues.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-40170 addresses a vulnerability in the Linux kernel's networking stack where accesses to the destination device pointer (dst->dev) were not properly protected by RCU mechanisms in functions such as sk_setup_caps(), sk_dst_gso_max_size(), ip6_dst_mtu_maybe_forward(), ip_dst_mtu_maybe_forward(), and ip4_dst_hoplimit(). This could lead to use-after-free or similar memory corruption issues. The patch introduces the use of dst_dev_rcu() and dst_dev_net_rcu() to ensure safe concurrent access to these pointers.
Potential Impact
The vulnerability allows an attacker with local access (low privileges) to potentially cause confidentiality, integrity, and availability impacts on the affected system due to improper synchronization in kernel network code. This could lead to kernel memory corruption or crashes, impacting system stability and security.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to use RCU protection for accesses to dst->dev in the affected functions. Users should update to a Linux kernel version that includes this patch. Since no specific patched versions are provided, check the vendor or kernel mailing list advisories for the exact fixed versions and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3vr4-gx8q-4fgg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40170"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d69c2644c7f847a8aa
Added to database: 07/30/2026, 15:50:46 UTC
Last enriched: 07/30/2026, 16:53:07 UTC
Last updated: 07/31/2026, 19:24:49 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.