CVE-2025-40170High· 7.8▾ Twilight

net: use dst_dev_rcu() in sk_setup_caps()

In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mt…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 12, 2025

Updated

Oct 21, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.19% · p9

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-06-16

Exploitation: none
Automatable: yes
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 21.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 348 days

Nov 12, 2025Published
Disclosed via CVEORG
Oct 21, 2026Record revised
Last analysed / modified upstream
Oct 21, 2026EPSS first tracked
0.2%
Oct 26, 2026EPSS peak
0.2% → 0.2%

Linux #cve.org

Affected

Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 9f22b5f7f1a32f8bbcc82bf34e34ea63523fcd02
Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 5d1be493d1110c9e720b4c51a6e587bb2fb4ac12
Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < a805729c0091073d8f0415cfa96c7acd1bc17a48
Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 99a2ace61b211b0be861b07fbaa062fca4b58879
Linux 4.13

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

net: use dst_dev_rcu() in sk_setup_caps()

Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size().

Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward().

ip4_dst_hoplimit() can use dst_dev_net_rcu().

Affected

Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 9f22b5f7f1a32f8bbcc82bf34e34ea63523fcd02
Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 5d1be493d1110c9e720b4c51a6e587bb2fb4ac12
Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < a805729c0091073d8f0415cfa96c7acd1bc17a48
Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 99a2ace61b211b0be861b07fbaa062fca4b58879
Linux 4.13

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

net: use dst_dev_rcu() in sk_setup_caps()

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

net: use dst_dev_rcu() in sk_setup_caps()

Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size().

Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward().

ip4_dst_hoplimit() can use dst_dev_net_rcu().

Affected

Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 9f22b5f7f1a32f8bbcc82bf34e34ea63523fcd02

Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 5d1be493d1110c9e720b4c51a6e587bb2fb4ac12

Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < a805729c0091073d8f0415cfa96c7acd1bc17a48

Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 < 99a2ace61b211b0be861b07fbaa062fca4b58879

Linux 4.13