Use-After-Free Vulnerability in Linux Kernel's Networking Interface

CVE-2025-40271

What is CVE-2025-40271?

A use-after-free vulnerability in the Linux kernel's networking interface may allow an attacker to access freed memory. The issue arises in the proc_readdir_de() function when directory entries are concurrently modified while being traversed. During high-stress scenarios, unregistering network devices leads to a race condition where previously valid references may still be used after being freed. This can expose sensitive data or lead to system crashes. Proper handling of erased nodes in the Red-Black tree structure is mandated to mitigate this risk, ensuring that dereferenced pointers do not return to freed memory.

References