CVE-2025-40139

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-40139
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40139.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-40139
Downstream
Related
Published
2025-11-12T10:23:24.216Z
Modified
2026-09-04T03:31:01.563769304Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
Details

In the Linux kernel, the following vulnerability has been resolved:

smc: Use _skdstget() and dstdevrcu() in in smcclcprfxset().

smcclcprfx_set() is called during connect() and not under RCU nor RTNL.

Using skdstget(sk)->dev could trigger UAF.

Let's use _skdstget() and devdstrcu() under rcureadlock() after kernelgetsockname().

Note that the returned value of smcclcprfx_set() is not used in the caller.

While at it, we change the 1st arg of smcclcprfx_set[46]_rcu() not to touch dst there.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40139.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a046d57da19f812216f393e7c535f5858f793ac3
Fixed
5a2fccc4b32c13ddde3676f9e15e1a9baa7d6fde
Fixed
80d1fd39f4e37d836655e9f7ffccaf78925049bf
Fixed
956c57daba55cf9ed25d9f2512883b8a1a927599
Fixed
0736993bfe5c7a9c744ae3fac62d769dfdae54e1
Fixed
935d783e5de9b64587f3adb25641dd8385e64ddb

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40139.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.11.0
Fixed
6.1.187
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.156
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.108
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.17.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40139.json"