{"id":"CVE-2025-40018","title":"ipvs: Defer ip_vs_ftp unregister during netns cleanup","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: Defer ip_vs_ftp unregister during netns cleanup\n\nOn the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp\nbefore connections with valid cp->app poin…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 8a6ecab3847c213ce2855b0378e63ce839085de3","Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 421b1ae1574dfdda68b835c15ac4921ec0030182","Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 1d79471414d7b9424d699afff2aa79fff322f52d","Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 53717f8a4347b78eac6488072ad8e5adbaff38d9","Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 8cbe2a21d85727b66d7c591fd5d83df0d8c4f757","Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < dc1a481359a72ee7e548f1f5da671282a7c13b8f","Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < a343811ef138a265407167294275201621e9ebb2","Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 134121bfd99a06d44ef5ba15a9beb075297c0821","Linux 2.6.39"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:56:10.486457Z"},"published":"2025-10-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:36.226Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40018","references":[{"url":"https://git.kernel.org/stable/c/8a6ecab3847c213ce2855b0378e63ce839085de3"},{"url":"https://git.kernel.org/stable/c/421b1ae1574dfdda68b835c15ac4921ec0030182"},{"url":"https://git.kernel.org/stable/c/1d79471414d7b9424d699afff2aa79fff322f52d"},{"url":"https://git.kernel.org/stable/c/53717f8a4347b78eac6488072ad8e5adbaff38d9"},{"url":"https://git.kernel.org/stable/c/8cbe2a21d85727b66d7c591fd5d83df0d8c4f757"},{"url":"https://git.kernel.org/stable/c/dc1a481359a72ee7e548f1f5da671282a7c13b8f"},{"url":"https://git.kernel.org/stable/c/a343811ef138a265407167294275201621e9ebb2"},{"url":"https://git.kernel.org/stable/c/134121bfd99a06d44ef5ba15a9beb075297c0821"}],"tags":["cve.org"],"epss":0.0015,"epssPercentile":0.04134,"ingestedAt":"2026-10-15T22:48:25.538Z","slug":"CVE-2025-40018","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvs: Defer ip_vs_ftp unregister during netns cleanup\n\nOn the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp\nbefore connections with valid cp->app pointers are flushed, leading to a\nuse-after-free.\n\nFix this by introducing a global `exiting_module` flag, set to true in\nip_vs_ftp_exit() before unregistering the pernet subsystem. In\n__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns\ncleanup (when exiting_module is false) and defer it to\n__ip_vs_cleanup_batch(), which unregisters all apps after all connections\nare flushed. If called during module exit, unregister ip_vs_ftp\nimmediately.\n\n## Affected\n\n- `Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 8a6ecab3847c213ce2855b0378e63ce839085de3`\n- `Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 421b1ae1574dfdda68b835c15ac4921ec0030182`\n- `Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 1d79471414d7b9424d699afff2aa79fff322f52d`\n- `Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 53717f8a4347b78eac6488072ad8e5adbaff38d9`\n- `Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 8cbe2a21d85727b66d7c591fd5d83df0d8c4f757`\n- `Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < dc1a481359a72ee7e548f1f5da671282a7c13b8f`\n- `Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < a343811ef138a265407167294275201621e9ebb2`\n- `Linux >= 61b1ab4583e275af216c8454b9256de680499b19 < 134121bfd99a06d44ef5ba15a9beb075297c0821`\n- `Linux 2.6.39`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}