Use-After-Free Vulnerability in Linux Kernel Affects Networking Components

CVE-2025-40074

What is CVE-2025-40074?

A use-after-free vulnerability exists in the Linux kernel affecting multiple networking functions. Specifically, modifications were made to the 'icmpv4_xrlim_allow()' and 'ip_defrag()' functions that mitigate the risk of potential memory access issues. Additionally, changes were implemented in 'ipmr_prepare_xmit()', 'ipmr_queue_fwd_xmit()', and 'ipv4_neigh_lookup()' to ensure proper memory management by utilizing the newly implemented 'dst_dev_rcu()' for enhanced safety in the handling of network packets.

References