BPF Metadata Leak in Linux Kernel Affecting Cilium's Egress Gateway Feature

CVE-2025-40183

What is CVE-2025-40183?

A vulnerability in the Linux kernel's BPF subsystem has been identified, specifically impacting Cilium's egress gateway functionality. This flaw occurs when forward packets are managed through the bpf_redirect_neigh() helper. The issue arises from the vxlan mechanism that allocates the metadata_dst object without releasing existing dst entries. Consequently, this oversight leads to a growth in kmalloc-256 slab usage over time, potentially causing performance degradation due to increased memory consumption during packet processing. The proper releasing of dst entries is critical to maintain system stability and performance.

References