High 7.8Published Nov 12, 2025

CVE-2025-40170net: use dst_dev_rcu() in sk_setup_caps()

Updated under an hour ago (Oct 27, 2026, 4:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward(). ip4_dst_hoplimit() can use dst_dev_net_rcu().

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 before 9f22b5f7f1a32f8bbcc82bf34e34ea63523fcd02; from 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 before 5d1be493d1110c9e720b4c51a6e587bb2fb4ac12; from 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 before a805729c0091073d8f0415cfa96c7acd1bc17a48; from 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 before 99a2ace61b211b0be861b07fbaa062fca4b58879	CNA record

References

References

https://git.kernel.org/stable/c/9f22b5f7f1a32f8bbcc82bf34e34ea63523fcd02
https://git.kernel.org/stable/c/5d1be493d1110c9e720b4c51a6e587bb2fb4ac12
https://git.kernel.org/stable/c/a805729c0091073d8f0415cfa96c7acd1bc17a48
https://git.kernel.org/stable/c/99a2ace61b211b0be861b07fbaa062fca4b58879

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.