In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (CVE-2025-40168)
In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the returned value of smc_clc_prfx_match() is not used in the caller.
AI Analysis
Technical Summary
The Red Hat kernel security update addresses three vulnerabilities in the Linux kernel: CVE-2025-40168 fixes a use-after-free in the smc subsystem by changing how socket destination references are obtained; CVE-2025-71085 resolves a kernel BUG triggered during IPv6 packet buffer attribute setting; CVE-2026-23097 mitigates a denial of service caused by a deadlock during hugetlb folio migration. These vulnerabilities affect Red Hat Enterprise Linux 9 and its variants. The update requires installation of patched kernel packages and a system reboot. No CVSS scores are provided in the advisory, but Red Hat rates the impact as moderate.
Potential Impact
Successful exploitation of these vulnerabilities could lead to kernel instability including denial of service conditions and potential memory corruption. The use-after-free and kernel BUG could cause system crashes or unpredictable behavior. The deadlock vulnerability specifically results in denial of service by halting hugetlb folio migration. There are no known exploits in the wild at the time of the advisory.
Mitigation Recommendations
Red Hat has released an official kernel update that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:3488 and reboot their systems to ensure the fixes take effect. No additional mitigations are indicated or required beyond applying the official patch and rebooting.
In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (CVE-2025-40168)
Description
In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the returned value of smc_clc_prfx_match() is not used in the caller.
CVSS v3.1
Score 8.1high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat kernel security update addresses three vulnerabilities in the Linux kernel: CVE-2025-40168 fixes a use-after-free in the smc subsystem by changing how socket destination references are obtained; CVE-2025-71085 resolves a kernel BUG triggered during IPv6 packet buffer attribute setting; CVE-2026-23097 mitigates a denial of service caused by a deadlock during hugetlb folio migration. These vulnerabilities affect Red Hat Enterprise Linux 9 and its variants. The update requires installation of patched kernel packages and a system reboot. No CVSS scores are provided in the advisory, but Red Hat rates the impact as moderate.
Potential Impact
Successful exploitation of these vulnerabilities could lead to kernel instability including denial of service conditions and potential memory corruption. The use-after-free and kernel BUG could cause system crashes or unpredictable behavior. The deadlock vulnerability specifically results in denial of service by halting hugetlb folio migration. There are no known exploits in the wild at the time of the advisory.
Mitigation Recommendations
Red Hat has released an official kernel update that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:3488 and reboot their systems to ensure the fixes take effect. No additional mitigations are indicated or required beyond applying the official patch and rebooting.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:3488
- Cve Count
- 3
- Additional Cves
- ["CVE-2025-71085","CVE-2026-23097"]
- Cvss Version
- 3.1
Threat ID: 6a343e2df198dc38c151cc2d
Added to database: 06/18/2026, 18:51:25 UTC
Last enriched: 06/25/2026, 23:18:51 UTC
Last updated: 09/10/2026, 19:24:56 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.