High 7.8Published Nov 12, 2025

CVE-2025-40139smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().

Updated under an hour ago (Oct 27, 2026, 4:30 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() is not used in the caller. While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a046d57da19f812216f393e7c535f5858f793ac3 before 5a2fccc4b32c13ddde3676f9e15e1a9baa7d6fde; from a046d57da19f812216f393e7c535f5858f793ac3 before 80d1fd39f4e37d836655e9f7ffccaf78925049bf; from a046d57da19f812216f393e7c535f5858f793ac3 before 956c57daba55cf9ed25d9f2512883b8a1a927599; from a046d57da19f812216f393e7c535f5858f793ac3 before 0736993bfe5c7a9c744ae3fac62d769dfdae54e1; from a046d57da19f812216f393e7c535f5858f793ac3 before 935d783e5de9b64587f3adb25641dd8385e64ddb	CNA record

References

References

https://git.kernel.org/stable/c/5a2fccc4b32c13ddde3676f9e15e1a9baa7d6fde
https://git.kernel.org/stable/c/80d1fd39f4e37d836655e9f7ffccaf78925049bf
https://git.kernel.org/stable/c/956c57daba55cf9ed25d9f2512883b8a1a927599
https://git.kernel.org/stable/c/0736993bfe5c7a9c744ae3fac62d769dfdae54e1
https://git.kernel.org/stable/c/935d783e5de9b64587f3adb25641dd8385e64ddb

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.