CVE-2025-40075 is a vulnerability in the Linux kernel's tcp_metrics code where three calls to dst_dev() were replaced with a lockdep-enabled helper dst_dev_net_rcu() to improve locking correctness and prevent potential issues. The vulnerability has been resolved upstream in the Linux kernel source. The CVSS v3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

The vulnerability could allow an attacker to impact confidentiality, integrity, and availability of the affected Linux kernel networking subsystem due to improper locking in tcp_metrics. The CVSS score indicates high severity with network attack vector and no privileges required, suggesting potential remote exploitation. However, no known exploits are reported in the wild.

A fix has been implemented upstream in the Linux kernel by replacing dst_dev() calls with dst_dev_net_rcu(). Although no explicit patch links or affected versions are provided, users should update to the latest Linux kernel versions where this fix is included. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or repositories for the exact fixed versions and apply updates accordingly.