In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix metadatadst leak _bpfredirectneigh_v{4,6}
Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster.
The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpfredirectneigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing.
The issue was that vxlan allocates the metadatadst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpfredirectneigh() was merely setting the new dst entry via skbdst_set() without dropping an existing one first.
[
{
"id": "CVE-2025-40183-0f23f442",
"signature_version": "v1",
"digest": {
"length": 940.0,
"function_hash": "283967670203975545970679446789047887651"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@057764172fcc6ee2ccb6c41351a55a9f054dc8fd",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v4"
}
},
{
"id": "CVE-2025-40183-12d5d1ba",
"signature_version": "v1",
"digest": {
"length": 912.0,
"function_hash": "100031649236833821562744665039275474352"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23f3770e1a53e6c7a553135011f547209e141e72",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v6"
}
},
{
"id": "CVE-2025-40183-2f5db7fd",
"signature_version": "v1",
"digest": {
"length": 948.0,
"function_hash": "165501152644211603674430152020800104147"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7404ce888a45eb7da0508b7cbbe6f2e95302eeb8",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v4"
}
},
{
"id": "CVE-2025-40183-348f17fd",
"signature_version": "v1",
"digest": {
"length": 910.0,
"function_hash": "180713332387106296243805771505957459912"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@057764172fcc6ee2ccb6c41351a55a9f054dc8fd",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v6"
}
},
{
"id": "CVE-2025-40183-3e48a912",
"signature_version": "v1",
"digest": {
"length": 912.0,
"function_hash": "100031649236833821562744665039275474352"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e67c2037382abb56497bb9d7b7e10be04eb5598",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v6"
}
},
{
"id": "CVE-2025-40183-49949a0b",
"signature_version": "v1",
"digest": {
"length": 912.0,
"function_hash": "100031649236833821562744665039275474352"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6bfe44b6dbb14a31d86c475cdc9c7689534fb09",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v6"
}
},
{
"id": "CVE-2025-40183-6312e9be",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65478247713367357735964928742125299990",
"165314276237711998632601409206185140781",
"245403641524764072189964996029480812933",
"146065586283166802453705547918300630237",
"168113221268904469615843462734046888598",
"48836454118459718774875710153553070715"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6bfe44b6dbb14a31d86c475cdc9c7689534fb09",
"target": {
"file": "net/core/filter.c"
}
},
{
"id": "CVE-2025-40183-7e1138e8",
"signature_version": "v1",
"digest": {
"length": 946.0,
"function_hash": "162270376119915802544763831381829612884"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f36a305d30f557306d87c787ddffe094ac5dac89",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v4"
}
},
{
"id": "CVE-2025-40183-82420c51",
"signature_version": "v1",
"digest": {
"length": 912.0,
"function_hash": "100031649236833821562744665039275474352"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7404ce888a45eb7da0508b7cbbe6f2e95302eeb8",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v6"
}
},
{
"id": "CVE-2025-40183-82b93664",
"signature_version": "v1",
"digest": {
"length": 942.0,
"function_hash": "104188870256222040841970059321866504298"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e67c2037382abb56497bb9d7b7e10be04eb5598",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v4"
}
},
{
"id": "CVE-2025-40183-8481b4d1",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65478247713367357735964928742125299990",
"165314276237711998632601409206185140781",
"245403641524764072189964996029480812933",
"146065586283166802453705547918300630237",
"168113221268904469615843462734046888598",
"48836454118459718774875710153553070715"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e67c2037382abb56497bb9d7b7e10be04eb5598",
"target": {
"file": "net/core/filter.c"
}
},
{
"id": "CVE-2025-40183-9a096758",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65478247713367357735964928742125299990",
"165314276237711998632601409206185140781",
"245403641524764072189964996029480812933",
"146065586283166802453705547918300630237",
"168113221268904469615843462734046888598",
"48836454118459718774875710153553070715"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23f3770e1a53e6c7a553135011f547209e141e72",
"target": {
"file": "net/core/filter.c"
}
},
{
"id": "CVE-2025-40183-b56961e1",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65478247713367357735964928742125299990",
"165314276237711998632601409206185140781",
"245403641524764072189964996029480812933",
"146065586283166802453705547918300630237",
"168113221268904469615843462734046888598",
"48836454118459718774875710153553070715"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fba965a9aac0fa3cbd8138436a37af9ab466d79",
"target": {
"file": "net/core/filter.c"
}
},
{
"id": "CVE-2025-40183-b72e0ee8",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65478247713367357735964928742125299990",
"165314276237711998632601409206185140781",
"245403641524764072189964996029480812933",
"146065586283166802453705547918300630237",
"168113221268904469615843462734046888598",
"48836454118459718774875710153553070715"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7404ce888a45eb7da0508b7cbbe6f2e95302eeb8",
"target": {
"file": "net/core/filter.c"
}
},
{
"id": "CVE-2025-40183-c19b8b9c",
"signature_version": "v1",
"digest": {
"length": 942.0,
"function_hash": "104188870256222040841970059321866504298"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6bfe44b6dbb14a31d86c475cdc9c7689534fb09",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v4"
}
},
{
"id": "CVE-2025-40183-c55cd268",
"signature_version": "v1",
"digest": {
"length": 912.0,
"function_hash": "100031649236833821562744665039275474352"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f36a305d30f557306d87c787ddffe094ac5dac89",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v6"
}
},
{
"id": "CVE-2025-40183-c811ca5e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65478247713367357735964928742125299990",
"165314276237711998632601409206185140781",
"245403641524764072189964996029480812933",
"146065586283166802453705547918300630237",
"168113221268904469615843462734046888598",
"48836454118459718774875710153553070715"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f36a305d30f557306d87c787ddffe094ac5dac89",
"target": {
"file": "net/core/filter.c"
}
},
{
"id": "CVE-2025-40183-d50bd138",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65478247713367357735964928742125299990",
"165314276237711998632601409206185140781",
"245403641524764072189964996029480812933",
"146065586283166802453705547918300630237",
"168113221268904469615843462734046888598",
"48836454118459718774875710153553070715"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@057764172fcc6ee2ccb6c41351a55a9f054dc8fd",
"target": {
"file": "net/core/filter.c"
}
},
{
"id": "CVE-2025-40183-dd5a9ee7",
"signature_version": "v1",
"digest": {
"length": 910.0,
"function_hash": "180713332387106296243805771505957459912"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fba965a9aac0fa3cbd8138436a37af9ab466d79",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v6"
}
},
{
"id": "CVE-2025-40183-e09b6c34",
"signature_version": "v1",
"digest": {
"length": 936.0,
"function_hash": "25913670699957408805042488363101537670"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23f3770e1a53e6c7a553135011f547209e141e72",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v4"
}
},
{
"id": "CVE-2025-40183-fb9d3531",
"signature_version": "v1",
"digest": {
"length": 940.0,
"function_hash": "283967670203975545970679446789047887651"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fba965a9aac0fa3cbd8138436a37af9ab466d79",
"target": {
"file": "net/core/filter.c",
"function": "__bpf_redirect_neigh_v4"
}
}
]