SB2025111318 - Use-after-free in Linux kernel ipv4
Published: November 13, 2025
Security Bulletin ID
SB2025111318
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2025-40186)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the tcp_conn_request() function in net/ipv4/tcp_input.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/2e7cbbbe3d61c63606994b7ff73c72537afe2e1c
- https://git.kernel.org/stable/c/422c1c173c39bbbae1e0eaaf8aefe40b2596233b
- https://git.kernel.org/stable/c/643a94b0cf767325e953591c212be2eb826b9d7f
- https://git.kernel.org/stable/c/64dc47a13aa3d9daf7cec29b44dca8e22a6aea15
- https://git.kernel.org/stable/c/c11ace909e873118295e9eb22dc8c58b0b50eb32
- https://git.kernel.org/stable/c/e359b742eac1eac75cff4e38ee2e8cea492acd9b
- https://git.kernel.org/stable/c/eb85ad5f23268d64b037bfb545cbcba3752f90c7
- https://git.kernel.org/stable/c/ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d