Security readout for executives and security teams
Plain-English summary
A flaw in Linux TCP metrics handling can potentially let a remote, unauthenticated attacker compromise confidentiality, integrity, and availability. Exploitation is rated high complexity, and the supplied sources do not describe prerequisites or confirm real-world attacks. Systems using affected kernels should be assessed and updated through their Linux vendor.
Executive priority
Treat as a high-priority patch-management issue, especially on network-facing Linux infrastructure. The potential impact is broad, but exploitation requires high complexity and is not confirmed active. Establish exposure promptly, then update through supported vendor channels using normal change controls.
Technical view
The kernel fix replaces three dst_dev() calls in tcp_metrics with dst_dev_net_rcu(), a lockdep-enabled helper. The supplied CVSS 3.1 score is 8.1: network-accessible, high-complexity, unauthenticated, requiring no user interaction, with potentially high confidentiality, integrity, and availability impact. The source bundle does not identify a CWE or explain the precise failure mechanism.
Likely exposure
Exposure applies to systems running affected Linux kernel versions where the vulnerable TCP metrics path is reachable. The bundle lists 4.13, 6.12.63, 6.17.3, and 6.18, but provides unclear version boundaries. Distribution backports may change actual status, so installed vendor packages must be checked individually.
Exploitation context
The supplied CVSS indicates remote attack potential without privileges or user interaction, but high attack complexity. CVE-2025-40075 is not listed as KEV in the bundle, and no cited source confirms active exploitation or public exploit availability. Exact triggering conditions are not provided.
Researcher notes
The public description is unusually sparse and only identifies three helper substitutions in tcp_metrics. It does not document the underlying race, lifetime error, configuration dependency, or trigger conditions. Commit review and distribution advisories are necessary for precise reachability analysis; avoid inferring exploitability from the CVSS vector alone.
Mitigation direction
- Apply a Linux vendor kernel containing the referenced stable fix.
- Prioritize network-facing systems running versions identified as affected.
- Review distribution advisories for backported fixes and package-specific status.
- Use vendor-recommended mitigations if immediate kernel updating is unavailable.
Validation and detection
- Inventory running kernel versions across Linux hosts.
- Compare installed packages with current distribution security advisories.
- Confirm the deployed kernel contains the applicable referenced stable commit.
- Reboot updated systems when required, then verify the running kernel.
- Monitor vendor guidance for clarified affected-version boundaries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40075 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4b89397807eb04986427c4786d065e9442834ad4CVE reference, Linux
- https://git.kernel.org/stable/c/07613a95326ebad2d1b88d883cd72546025a4f3eCVE reference, Linux
- https://git.kernel.org/stable/c/50c127a69cd6285300931853b352a1918cfa180fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.