Heap Use After Free Vulnerability in Linux Kernel Affecting the Networking Stack

CVE-2025-40168

What is CVE-2025-40168?

A vulnerability exists in the Linux kernel's networking stack, specifically within the smc_clc_prfx_match() function. This issue arises from the function being called from smc_listen_work() without appropriate handling under RCU or RTNL. As a result, utilizing the sk_dst_get(sk)->dev could lead to a Use After Free (UAF) scenario. Although the value returned by smc_clc_prfx_match() is not utilized by its caller, the underlying flaw poses a risk to system integrity and can potentially be exploited. Developers and system administrators are advised to update to the latest version of the Linux kernel to mitigate this vulnerability.

References