In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get… (CVE-2025-40215)
A vulnerability in the Linux kernel's xfrm subsystem involves improper deletion of ipcomp fallback tunnels, which can lead to references remaining in kernel data structures and triggering warnings. The issue arises because fallback tunnels are deleted only when the last user state is destroyed, but references may still exist, preventing timely cleanup. This can occur due to deferred freeing of socket buffers (skbs) in TCP and IP reassembly scenarios. The fix involves deleting the fallback state immediately after the last dependent user state is deleted, ensuring proper resource cleanup and avoiding kernel warnings.
AI Analysis
Technical Summary
CVE-2025-40215 addresses a vulnerability in the Linux kernel's xfrm subsystem related to the deletion of ipcomp fallback tunnels. The fallback tunnels remain in kernel lists and hashtables if references to user states still exist, causing warnings in xfrm_state_fini. Previous fixes for related issues in TCP and IP reassembly did not fully resolve the problem. The patch deletes the fallback state as soon as the last user state depending on it is deleted, with destruction occurring when the final reference is dropped. This requires a separate lockdep class for the fallback state due to locking order changes.
Potential Impact
The vulnerability can cause kernel warnings and potentially unstable kernel behavior due to lingering references to fallback tunnels in kernel data structures. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), implying that exploitation could lead to severe system compromise or denial of service. However, no known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates a patch has been developed to fix the issue by changing the deletion timing of fallback states. Until an official fix is confirmed, monitoring vendor advisories for updates and applying kernel updates promptly when available is recommended.
In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get… (CVE-2025-40215)
Description
A vulnerability in the Linux kernel's xfrm subsystem involves improper deletion of ipcomp fallback tunnels, which can lead to references remaining in kernel data structures and triggering warnings. The issue arises because fallback tunnels are deleted only when the last user state is destroyed, but references may still exist, preventing timely cleanup. This can occur due to deferred freeing of socket buffers (skbs) in TCP and IP reassembly scenarios. The fix involves deleting the fallback state immediately after the last dependent user state is deleted, ensuring proper resource cleanup and avoiding kernel warnings.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-40215 addresses a vulnerability in the Linux kernel's xfrm subsystem related to the deletion of ipcomp fallback tunnels. The fallback tunnels remain in kernel lists and hashtables if references to user states still exist, causing warnings in xfrm_state_fini. Previous fixes for related issues in TCP and IP reassembly did not fully resolve the problem. The patch deletes the fallback state as soon as the last user state depending on it is deleted, with destruction occurring when the final reference is dropped. This requires a separate lockdep class for the fallback state due to locking order changes.
Potential Impact
The vulnerability can cause kernel warnings and potentially unstable kernel behavior due to lingering references to fallback tunnels in kernel data structures. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), implying that exploitation could lead to severe system compromise or denial of service. However, no known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates a patch has been developed to fix the issue by changing the deletion timing of fallback states. Until an official fix is confirmed, monitoring vendor advisories for updates and applying kernel updates promptly when available is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-346r-c6v5-7g38
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40215"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d69c2644c7f847a8b0
Added to database: 07/30/2026, 15:50:46 UTC
Last enriched: 07/30/2026, 16:52:56 UTC
Last updated: 09/10/2026, 19:38:48 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.