Home

Description

In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the returned value of smc_clc_prfx_match() is not used in the caller.

PUBLISHED Reserved 2025-04-16 | Published 2025-11-12 | Updated 2025-12-01 | Assigner Linux

Product status

Default status
unaffected

a046d57da19f812216f393e7c535f5858f793ac3 (git) before d26e80f7fb62d77757b67a1b94e4ac756bc9c658
affected

a046d57da19f812216f393e7c535f5858f793ac3 (git) before 235f81045c008169cc4e1955b4a64e118eebe61b
affected

Default status
affected

4.11
affected

Any version before 4.11
unaffected

6.17.3 (semver)
unaffected

6.18 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/d26e80f7fb62d77757b67a1b94e4ac756bc9c658

git.kernel.org/...c/235f81045c008169cc4e1955b4a64e118eebe61b

cve.org (CVE-2025-40168)

nvd.nist.gov (CVE-2025-40168)

Download JSON