LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup

In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel cleanup-order flaw can leave IPVS FTP connections pointing to freed memory. A local, low-privileged user could potentially trigger memory corruption during network-namespace cleanup, threatening confidentiality, integrity, and availability. Exposure depends on the affected kernel code and relevant IPVS FTP functionality being present and used.

Executive priority

Treat as a high-priority local privilege-boundary risk, especially on shared, containerized, or load-balancing Linux hosts. Patch through normal expedited kernel maintenance after confirming vendor applicability. Immediate emergency action is less clearly justified because the supplied evidence shows neither remote reachability nor active exploitation.

Technical view

During network-namespace teardown, __ip_vs_ftp_exit() could unregister ip_vs_ftp before connections holding valid cp->app pointers were flushed, causing a use-after-free. The kernel fix defers application unregistering until connection cleanup finishes, except during module exit. CVSS 3.1 is 7.8: local access, low complexity, low privileges, no user interaction, and high impacts.

Likely exposure

Potentially exposed systems run an affected Linux kernel and use the IPVS FTP application helper with network namespaces. Containers, load-balancing hosts, or other namespace-heavy systems may deserve closer review, but the supplied sources do not establish specific distributions, configurations, or backport status. The listed version data includes an ambiguous "0" entry.

Exploitation context

The supplied CVSS vector describes local, low-privileged exploitation without user interaction; this is not a remote network attack as scored. The source bundle marks the CVE as absent from KEV and provides no evidence of active exploitation, public exploit availability, or confirmed attacks.

Researcher notes

The flaw is a teardown-order use-after-free involving ip_vs_ftp registration and lingering connection cp->app pointers. No CWE is supplied. Exact downstream exposure requires vendor backport analysis because distribution kernels may carry fixes without matching upstream version numbers. The bundle provides multiple stable commits but no exploitability demonstration or attack telemetry.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable stable fix or backport.
  • Prioritize systems using IPVS FTP functionality and frequent network-namespace lifecycle operations.
  • Reboot into the corrected kernel after updating, following distribution guidance.
  • If patching is delayed, consult the Linux distribution for supported temporary mitigations.

Validation and detection

  • Inventory running kernel versions and distribution backport status across Linux systems.
  • Determine whether the IPVS FTP helper and network namespaces are enabled or used.
  • Map the installed kernel source or vendor advisory to the referenced stable fix commit.
  • After remediation, confirm each system is running the corrected kernel, not merely storing it.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40018 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-40018Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux61b1ab4583e275af216c8454b9256de680499b19, 61b1ab4583e275af216c8454b9256de680499b19, 61b1ab4583e275af216c8454b9256de680499b19, 61b1ab4583e275af216c8454b9256de680499b19, 61b1ab4583e275af216c8454b9256de680499b19, 61b1ab4583e275af216c8454b9256de680499b19, 61b1ab4583e275af216c8454b9256de680499b19, 61b1ab4583e275af216c8454b9256de680499b19unaffected
LinuxLinux2.6.39, 0, 5.4.301, 5.10.246, 5.15.195, 6.1.156, 6.6.112, 6.12.53, 6.17.3, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.