Security readout for executives and security teams
Plain-English summary
A Linux kernel IPv6 output flaw can cause use-after-free memory access. Under specific race conditions, it may compromise confidentiality, integrity, or availability. The supplied CVSS score is 8.1, but attack complexity is high and public evidence does not establish active exploitation.
Executive priority
Treat as a high-priority patching issue for exposed or critical Linux systems, while avoiding emergency claims unsupported by exploitation evidence. Establish affected inventory promptly and deploy tested vendor kernel updates through normal accelerated change procedures.
Technical view
ip6_output() accessed destination-device state without the required RCU protection, creating a possible use-after-free condition. The resolution adds RCU handling so dst_dev_rcu() can be used safely and removes redundant RCU locking from ip6_finish_output2().
Likely exposure
Potential exposure exists on affected Linux systems using IPv6 networking, especially network-reachable workloads processing IPv6 traffic. The supplied version data includes ambiguous entries, including “0,” so exact affected release boundaries should be confirmed against kernel or distribution guidance.
Exploitation context
The CVSS vector indicates network access, no privileges, and no user interaction, with high attack complexity and potentially high confidentiality, integrity, and availability impact. The CVE is not listed as KEV, and the supplied sources provide no evidence of exploitation in the wild.
Researcher notes
The core issue is an IPv6 output-path lifetime race addressed through RCU-protected device access. The bundle does not identify a CWE, triggering conditions, crash signatures, exploit proof, or complete version-range semantics. Researchers should rely on the referenced commits and distribution backport records for precise exposure assessment.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced RCU fix.
- Check distribution advisories for exact affected and fixed package versions.
- Prioritize internet-facing or critical systems that process IPv6 traffic.
- Use vendor-recommended temporary mitigations if immediate patching is unavailable.
Validation and detection
- Inventory running kernel versions and distribution package revisions.
- Confirm whether vendor packages contain either referenced stable-kernel fix commit.
- Verify patched systems booted into the updated kernel.
- Review vendor advisories to resolve the source bundle’s ambiguous version boundaries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40158 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0393f85c3241c19ba8550f04a812e7d19f6b3082CVE reference, Linux
- https://git.kernel.org/stable/c/11709573cc4e48dc34c80fc7ab9ce5b159e29695CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.