In the Linux kernel, the following vulnerability has been resolved:
net/ip6_tunnel: Prevent perpetual tunnel growth
Similarly to ipv4 tunnel, ipv6 version updates dev->neededheadroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: iptunnel: prevent perpetual headroom growth"), ipv6 tunnel yet increases the headroom without any ceiling.
Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
Credits to Francesco Ruggeri, who was originally debugging this issue and wrote local Arista-specific patch and a reproducer.
[
{
"id": "CVE-2025-40173-1058ed7c",
"signature_version": "v1",
"digest": {
"function_hash": "88967119154452481888150379325937187732",
"length": 4364.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f6066af3bfb8149aa16c42c0b0c5ea5b199a94",
"target": {
"file": "net/ipv6/ip6_tunnel.c",
"function": "ip6_tnl_xmit"
}
},
{
"id": "CVE-2025-40173-1ea456ac",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"3094149249230533114317737667667746264",
"13235671966455917172338761742428124248",
"306952147764860937635466677412604396883",
"141555911238767898862400746479275710363",
"186118112287626487742824300462956191308"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48294a67863c9cfa367abb66bbf0ef6548ae124f",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
}
},
{
"id": "CVE-2025-40173-20422720",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169628687530656271717793000105015473471",
"9985952497296013848354379471867696870",
"13250327788632090158574899102998993636"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@402b6985e872b4cf394bbbf33b503947a326a6cb",
"target": {
"file": "include/net/ip_tunnels.h"
}
},
{
"id": "CVE-2025-40173-26015e4d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"3094149249230533114317737667667746264",
"13235671966455917172338761742428124248",
"306952147764860937635466677412604396883",
"141555911238767898862400746479275710363",
"186118112287626487742824300462956191308"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eeb4345488672584db4f8c20a1ae13a212ce31c4",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
}
},
{
"id": "CVE-2025-40173-28eaf6ef",
"signature_version": "v1",
"digest": {
"function_hash": "143179184687094669176851222322498356594",
"length": 240.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6eb25d870f1a8ae571fd3da2244b71df547824b",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_adj_headroom"
}
},
{
"id": "CVE-2025-40173-2f48f668",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"3094149249230533114317737667667746264",
"13235671966455917172338761742428124248",
"306952147764860937635466677412604396883",
"141555911238767898862400746479275710363",
"186118112287626487742824300462956191308"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f6066af3bfb8149aa16c42c0b0c5ea5b199a94",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
}
},
{
"id": "CVE-2025-40173-35969b52",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224672068139474937643439720147664253718",
"280220598549214113777254280375010418533",
"99819707359549748496654220677282981270",
"39854579241336215572115705939478136525",
"59488637716896063259748115432854902223",
"321082516049893019663012768152598237969",
"47211699678207132771251137369973701536",
"282708702841269984802482978460361280634",
"208270570466080724981700769189763438142",
"315078083862674169286687658808275278904",
"52757577149571324847901336207145682357"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f6066af3bfb8149aa16c42c0b0c5ea5b199a94",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"id": "CVE-2025-40173-38afd81d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224672068139474937643439720147664253718",
"280220598549214113777254280375010418533",
"99819707359549748496654220677282981270",
"39854579241336215572115705939478136525",
"59488637716896063259748115432854902223",
"321082516049893019663012768152598237969",
"47211699678207132771251137369973701536",
"282708702841269984802482978460361280634",
"208270570466080724981700769189763438142",
"315078083862674169286687658808275278904",
"52757577149571324847901336207145682357"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10fe967efe73c610e526ff7460581610633dee9c",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"id": "CVE-2025-40173-456648f0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169628687530656271717793000105015473471",
"9985952497296013848354379471867696870",
"13250327788632090158574899102998993636"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10fe967efe73c610e526ff7460581610633dee9c",
"target": {
"file": "include/net/ip_tunnels.h"
}
},
{
"id": "CVE-2025-40173-45f36e2a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224672068139474937643439720147664253718",
"280220598549214113777254280375010418533",
"99819707359549748496654220677282981270",
"39854579241336215572115705939478136525",
"59488637716896063259748115432854902223",
"321082516049893019663012768152598237969",
"47211699678207132771251137369973701536",
"282708702841269984802482978460361280634",
"208270570466080724981700769189763438142",
"315078083862674169286687658808275278904",
"52757577149571324847901336207145682357"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eeb4345488672584db4f8c20a1ae13a212ce31c4",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"id": "CVE-2025-40173-47a542c7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"181279684279038580919754242585189417709",
"284069215229316699611716823262156356694",
"260176428038590407995411598903489703138"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566f8d5c8a443f2dd69c5460fdec43ed1c870c65",
"target": {
"file": "include/net/ip_tunnels.h"
}
},
{
"id": "CVE-2025-40173-578594a3",
"signature_version": "v1",
"digest": {
"function_hash": "143179184687094669176851222322498356594",
"length": 240.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f6066af3bfb8149aa16c42c0b0c5ea5b199a94",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_adj_headroom"
}
},
{
"id": "CVE-2025-40173-6401d88c",
"signature_version": "v1",
"digest": {
"function_hash": "174818811099986254613008128095179236091",
"length": 4595.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eeb4345488672584db4f8c20a1ae13a212ce31c4",
"target": {
"file": "net/ipv6/ip6_tunnel.c",
"function": "ip6_tnl_xmit"
}
},
{
"id": "CVE-2025-40173-69845dd7",
"signature_version": "v1",
"digest": {
"function_hash": "143179184687094669176851222322498356594",
"length": 240.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eeb4345488672584db4f8c20a1ae13a212ce31c4",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_adj_headroom"
}
},
{
"id": "CVE-2025-40173-69e5509f",
"signature_version": "v1",
"digest": {
"function_hash": "143179184687094669176851222322498356594",
"length": 240.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@402b6985e872b4cf394bbbf33b503947a326a6cb",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_adj_headroom"
}
},
{
"id": "CVE-2025-40173-72467f19",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224672068139474937643439720147664253718",
"280220598549214113777254280375010418533",
"99819707359549748496654220677282981270",
"39854579241336215572115705939478136525",
"59488637716896063259748115432854902223",
"321082516049893019663012768152598237969",
"47211699678207132771251137369973701536",
"282708702841269984802482978460361280634",
"208270570466080724981700769189763438142",
"315078083862674169286687658808275278904",
"52757577149571324847901336207145682357"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566f8d5c8a443f2dd69c5460fdec43ed1c870c65",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"id": "CVE-2025-40173-97c09dcf",
"signature_version": "v1",
"digest": {
"function_hash": "129532213240802001990923302061892610350",
"length": 4594.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6eb25d870f1a8ae571fd3da2244b71df547824b",
"target": {
"file": "net/ipv6/ip6_tunnel.c",
"function": "ip6_tnl_xmit"
}
},
{
"id": "CVE-2025-40173-a83166af",
"signature_version": "v1",
"digest": {
"function_hash": "245907683988655743325767706025084523303",
"length": 4611.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10fe967efe73c610e526ff7460581610633dee9c",
"target": {
"file": "net/ipv6/ip6_tunnel.c",
"function": "ip6_tnl_xmit"
}
},
{
"id": "CVE-2025-40173-aabf7f3c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169628687530656271717793000105015473471",
"9985952497296013848354379471867696870",
"13250327788632090158574899102998993636"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f6066af3bfb8149aa16c42c0b0c5ea5b199a94",
"target": {
"file": "include/net/ip_tunnels.h"
}
},
{
"id": "CVE-2025-40173-ac510742",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169628687530656271717793000105015473471",
"9985952497296013848354379471867696870",
"13250327788632090158574899102998993636"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6eb25d870f1a8ae571fd3da2244b71df547824b",
"target": {
"file": "include/net/ip_tunnels.h"
}
},
{
"id": "CVE-2025-40173-ae71db4e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224672068139474937643439720147664253718",
"280220598549214113777254280375010418533",
"99819707359549748496654220677282981270",
"39854579241336215572115705939478136525",
"59488637716896063259748115432854902223",
"321082516049893019663012768152598237969",
"47211699678207132771251137369973701536",
"282708702841269984802482978460361280634",
"208270570466080724981700769189763438142",
"315078083862674169286687658808275278904",
"52757577149571324847901336207145682357"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48294a67863c9cfa367abb66bbf0ef6548ae124f",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"id": "CVE-2025-40173-b2c3116e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"3094149249230533114317737667667746264",
"13235671966455917172338761742428124248",
"306952147764860937635466677412604396883",
"141555911238767898862400746479275710363",
"186118112287626487742824300462956191308"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10fe967efe73c610e526ff7460581610633dee9c",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
}
},
{
"id": "CVE-2025-40173-b88b2326",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224672068139474937643439720147664253718",
"280220598549214113777254280375010418533",
"99819707359549748496654220677282981270",
"39854579241336215572115705939478136525",
"59488637716896063259748115432854902223",
"321082516049893019663012768152598237969",
"47211699678207132771251137369973701536",
"282708702841269984802482978460361280634",
"208270570466080724981700769189763438142",
"315078083862674169286687658808275278904",
"52757577149571324847901336207145682357"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6eb25d870f1a8ae571fd3da2244b71df547824b",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"id": "CVE-2025-40173-b9cc3cfe",
"signature_version": "v1",
"digest": {
"function_hash": "143179184687094669176851222322498356594",
"length": 240.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566f8d5c8a443f2dd69c5460fdec43ed1c870c65",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_adj_headroom"
}
},
{
"id": "CVE-2025-40173-bc227717",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"3094149249230533114317737667667746264",
"13235671966455917172338761742428124248",
"306952147764860937635466677412604396883",
"141555911238767898862400746479275710363",
"186118112287626487742824300462956191308"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566f8d5c8a443f2dd69c5460fdec43ed1c870c65",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
}
},
{
"id": "CVE-2025-40173-c307518f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"3094149249230533114317737667667746264",
"13235671966455917172338761742428124248",
"306952147764860937635466677412604396883",
"141555911238767898862400746479275710363",
"186118112287626487742824300462956191308"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@402b6985e872b4cf394bbbf33b503947a326a6cb",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
}
},
{
"id": "CVE-2025-40173-c982ac61",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"190509175615502822142010581840069183794",
"220421046010734307433878096952912571241",
"306952147764860937635466677412604396883",
"141555911238767898862400746479275710363",
"186118112287626487742824300462956191308"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6eb25d870f1a8ae571fd3da2244b71df547824b",
"target": {
"file": "net/ipv6/ip6_tunnel.c"
}
},
{
"id": "CVE-2025-40173-d1d9627b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169628687530656271717793000105015473471",
"9985952497296013848354379471867696870",
"13250327788632090158574899102998993636"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48294a67863c9cfa367abb66bbf0ef6548ae124f",
"target": {
"file": "include/net/ip_tunnels.h"
}
},
{
"id": "CVE-2025-40173-d262bc7c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169628687530656271717793000105015473471",
"9985952497296013848354379471867696870",
"13250327788632090158574899102998993636"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eeb4345488672584db4f8c20a1ae13a212ce31c4",
"target": {
"file": "include/net/ip_tunnels.h"
}
},
{
"id": "CVE-2025-40173-ead0a0c1",
"signature_version": "v1",
"digest": {
"function_hash": "143179184687094669176851222322498356594",
"length": 240.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48294a67863c9cfa367abb66bbf0ef6548ae124f",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_adj_headroom"
}
},
{
"id": "CVE-2025-40173-efc8c1aa",
"signature_version": "v1",
"digest": {
"function_hash": "88967119154452481888150379325937187732",
"length": 4364.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566f8d5c8a443f2dd69c5460fdec43ed1c870c65",
"target": {
"file": "net/ipv6/ip6_tunnel.c",
"function": "ip6_tnl_xmit"
}
},
{
"id": "CVE-2025-40173-f0d8002c",
"signature_version": "v1",
"digest": {
"function_hash": "174818811099986254613008128095179236091",
"length": 4595.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48294a67863c9cfa367abb66bbf0ef6548ae124f",
"target": {
"file": "net/ipv6/ip6_tunnel.c",
"function": "ip6_tnl_xmit"
}
},
{
"id": "CVE-2025-40173-f47d66cd",
"signature_version": "v1",
"digest": {
"function_hash": "88967119154452481888150379325937187732",
"length": 4364.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@402b6985e872b4cf394bbbf33b503947a326a6cb",
"target": {
"file": "net/ipv6/ip6_tunnel.c",
"function": "ip6_tnl_xmit"
}
},
{
"id": "CVE-2025-40173-f806e550",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224672068139474937643439720147664253718",
"280220598549214113777254280375010418533",
"99819707359549748496654220677282981270",
"39854579241336215572115705939478136525",
"59488637716896063259748115432854902223",
"321082516049893019663012768152598237969",
"47211699678207132771251137369973701536",
"282708702841269984802482978460361280634",
"208270570466080724981700769189763438142",
"315078083862674169286687658808275278904",
"52757577149571324847901336207145682357"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@402b6985e872b4cf394bbbf33b503947a326a6cb",
"target": {
"file": "net/ipv4/ip_tunnel.c"
}
},
{
"id": "CVE-2025-40173-fb8c64aa",
"signature_version": "v1",
"digest": {
"function_hash": "143179184687094669176851222322498356594",
"length": 240.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10fe967efe73c610e526ff7460581610633dee9c",
"target": {
"file": "net/ipv4/ip_tunnel.c",
"function": "ip_tunnel_adj_headroom"
}
}
]