CVE-2025-40135

HighCVSS 8.1/10Last modified Nov 10, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: use RCU in ip6_xmit()

Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36, < 7a228cfbb66cca49e9baf901c506364f8dfe036b; >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36, < f0a54d00d2f36de40266f47c27989853e8588656; >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36, < f69fec6287565fdeb61f65e700a1184352306943; >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36, < bd0905e2122e3680968cd0741966983490bf2ed3; >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36, < f7f9e924f23684b4b23cd9f976cceab24a968e34; >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36, < 9085e56501d93af9f2d7bd16f7fcfacdde47b99c
LinuxLinux4.13
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.7, < *

References

Timeline

Published
Nov 12, 2025
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-40136In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - request reserved interrupt for virtual function CVE-2025-40137In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate first page in error path of f2fs_truncate() syzbCVE-2025-40138In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistCVE-2025-401397.8In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smCVE-2025-40149.8A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability CVE-2025-401408.8In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast CVE-2025-401418.0In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix CVE-2025-40142In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPCVE-2025-40143In the Linux kernel, the following vulnerability has been resolved: bpf: dont report verifier bug for missing bpf_scc_visit on speculative CVE-2025-40145In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure CVE-2025-40146In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and frCVE-2025-40147In the Linux kernel, the following vulnerability has been resolved: blk-throttle: fix access race during throttle policy activation On rep
CVE-2025-40135: High severity, CVSS 8.1 | Vulnix