Security readout for executives and security teams
Plain-English summary
CVE-2025-40003 is a Linux kernel use-after-free in the MSCC Ocelot network switch statistics cleanup path. During device removal or failed initialization, delayed work can be requeued after its workqueue is destroyed, risking kernel instability.
Executive priority
Treat as a targeted kernel reliability issue, not an internet-wide emergency. Prioritize affected network appliances or Linux hosts using this driver, especially where unexpected kernel crashes would affect availability.
Technical view
The Ocelot stats teardown used cancel_delayed_work(), which may not stop a currently running delayed callback from rescheduling itself. The fix replaces it with disable_delayed_work_sync(), ensuring the work completes and cannot be queued again before destroying the workqueue.
Likely exposure
Exposure appears limited to Linux systems using the MSCC Ocelot networking driver paths. The source bundle lists Linux as affected, but exact supported version range interpretation is incomplete.
Exploitation context
No active exploitation is cited, and CISA KEV status is false. The source states the issue was found by static analysis and involves initialization failure or resource destruction paths, not a documented remote attack path.
Researcher notes
The root cause is delayed-work lifecycle misuse during teardown. Evidence supports a UAF condition, but public sources provided do not include CVSS, CWE, exploitability analysis, or a complete affected-version matrix.
Mitigation direction
- Update to a kernel or distribution package containing the referenced stable fixes.
- Check vendor or distribution advisories for exact fixed versions.
- Prioritize systems using MSCC Ocelot networking support.
- Avoid relying on locally invented workarounds without vendor guidance.
Validation and detection
- Inventory kernels and identify systems with MSCC Ocelot driver support.
- Confirm whether fixed stable commits are present in shipped kernel sources.
- Review logs for workqueue warnings involving ocelot-switch-stats.
- Test device removal or initialization-failure handling in staging after update.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40003 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/70acdd1eb35ffb3afdcb59e4c3bbb178da411d0fCVE reference, Linux
- https://git.kernel.org/stable/c/c3363db5d0685a8d077ade706051bbccc75f7e14CVE reference, Linux
- https://git.kernel.org/stable/c/bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.