Not yet scoredPublished Dec 4, 2025

CVE-2025-40256xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added

Updated under an hour ago (Oct 27, 2026, 2:30 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists. In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel. There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved. At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work).

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1b28a7fae0128fa140a7dccd995182ff6cd1c67b before 57b72d74d4651dc19d046308a8304eb9abfe66ac; 4b2c17d0f9be8b58bb30468bc81a4b61c985b04e builds before 1dad653643f28ccc89be93f9440b8804cded85b2; from 0da961fa46da1b37ef868d9b603bd202136f8f8e before 64441724387b4ac92f67ef51caaaeffe99c950d1; from d0e0d1097118461463b76562c7ebaabaa5b90b13 before 763e5c351206c1e4d910db4a1159053f6263689c; from dc3636912d41770466543623cb76e7b88fdb42c7 before f7d879c19d306512c2e260f37e8a3e5c85e37c50; from b441cf3f8c4b8576639d20c8eb4aa32917602ecd before d6fe5c740c573af10943b8353992e1325cdb2715; from b441cf3f8c4b8576639d20c8eb4aa32917602ecd before 10deb69864840ccf96b00ac2ab3a2055c0c04721	CNA record

References

References

https://git.kernel.org/stable/c/57b72d74d4651dc19d046308a8304eb9abfe66ac
https://git.kernel.org/stable/c/1dad653643f28ccc89be93f9440b8804cded85b2
https://git.kernel.org/stable/c/64441724387b4ac92f67ef51caaaeffe99c950d1
https://git.kernel.org/stable/c/763e5c351206c1e4d910db4a1159053f6263689c
https://git.kernel.org/stable/c/f7d879c19d306512c2e260f37e8a3e5c85e37c50
https://git.kernel.org/stable/c/d6fe5c740c573af10943b8353992e1325cdb2715
https://git.kernel.org/stable/c/10deb69864840ccf96b00ac2ab3a2055c0c04721

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.