CVE-2025-40149: Linux Kernel Use-After-Free Vulnerability

CVE-2025-40149 Overview

CVE-2025-40149 is a use-after-free (UAF) vulnerability in the Linux kernel's Transport Layer Security (TLS) subsystem. The flaw resides in the get_netdev_for_sock() function, which retrieves the underlying network device for a socket during setsockopt() calls. Because get_netdev_for_sock() runs outside of a Read-Copy-Update (RCU) critical section, calling sk_dst_get(sk)->dev can dereference a destination entry whose device has already been freed. The fix replaces the unsafe access pattern with __sk_dst_get() and dst_dev_rcu(). The vulnerability affects multiple stable branches of the Linux kernel and is tracked under [CWE-416: Use After Free].

Critical Impact
A local, authenticated attacker can trigger memory corruption in kernel space by racing socket configuration operations, potentially resulting in privilege escalation or kernel crashes.

Affected Products

Linux Kernel (multiple stable branches patched via commits 13159c7, 2b1bef1, c65f27b, e37ca00, f09cd20, feb474dd)
Distributions shipping affected upstream Linux kernel versions
Siemens products referenced under advisory SSA-019113

Discovery Timeline

2025-11-12 - CVE-2025-40149 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-40149

Vulnerability Analysis

The Linux kernel TLS (tls) subsystem uses get_netdev_for_sock() to identify the network device associated with a socket, typically to offload TLS operations to hardware. This lookup path executes during setsockopt(), which is not protected by RCU. The prior implementation called sk_dst_get(sk)->dev, which retrieves a reference-counted destination cache entry (dst_entry) and then dereferences its embedded dev pointer without RCU protection.

If the associated network device is torn down concurrently, the dev pointer inside the dst_entry may reference freed memory by the time it is read. The result is a classic use-after-free condition in kernel memory. On systems using bonding, the sole ->ndo_sk_get_lower_dev() implementation is bond_sk_get_lower_dev(), which requires an RCU read-side critical section, so the missing RCU coverage in the caller compounded the safety violation.

The upstream fix substitutes __sk_dst_get() (which returns the cached destination without taking an additional reference) combined with dst_dev_rcu() to safely read the device pointer inside an RCU-protected region.

Root Cause

The defect stems from executing a destination-to-device pointer traversal outside of an RCU read-side critical section. The socket destination cache and its device pointer can be invalidated and freed concurrently by network device removal, unbonding, or route flushing. Without RCU protection, no synchronization primitive prevents the kernel from reading a stale net_device pointer.

Attack Vector

Exploitation requires local, low-privileged access. The attacker opens a TLS-capable socket, then races setsockopt(TLS_TX/TLS_RX) operations against network device teardown or bonding reconfiguration on the interface associated with the socket. Winning the race causes get_netdev_for_sock() to dereference freed memory. Skilled attackers can shape the freed slab to control the contents of the reused allocation, converting the UAF into arbitrary kernel read/write and ultimately privilege escalation. The bug is not remotely reachable and requires an authenticated local user.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.161%.

Detection Methods for CVE-2025-40149

Indicators of Compromise

Kernel oops or panic traces referencing get_netdev_for_sock, tls_set_device_offload, or slab UAF signatures in net_device allocations
KASAN (Kernel Address Sanitizer) reports naming the tls subsystem and destination cache paths
Unexpected kernel crashes correlated with setsockopt(SOL_TLS, ...) calls from unprivileged processes

Detection Strategies

Enable KASAN and CONFIG_DEBUG_PAGEALLOC on test kernels to surface UAF conditions during fuzzing or validation
Audit installed kernel packages against the fixing commits listed in the Linux stable tree
Instrument syscall auditing (auditd) for repeated setsockopt calls with SOL_TLS from non-service accounts

Monitoring Recommendations

Forward kernel dmesg output and crash dumps to centralized logging for correlation across hosts
Alert on repeated segmentation faults or kernel oopses on hosts using kTLS offload or NIC bonding
Track kernel version inventory to identify systems still running vulnerable builds

How to Mitigate CVE-2025-40149

Immediate Actions Required

Identify all Linux hosts using kernel TLS (kTLS), particularly those with hardware TLS offload or NIC bonding enabled
Apply the vendor-supplied kernel updates from your distribution as soon as patched packages are available
Restrict local shell and container access on multi-tenant systems until patches are deployed

Patch Information

The vulnerability is fixed upstream by replacing sk_dst_get(sk)->dev with __sk_dst_get() and dst_dev_rcu() inside get_netdev_for_sock(). Fixes were merged across stable branches in the following commits: 13159c7, 2b1bef1, c65f27b, e37ca00, f09cd20, and feb474dd. Siemens users should consult SSA-019113 for product-specific guidance.

Workarounds

Disable kernel TLS offload where feasible by avoiding setsockopt(SOL_TLS, TLS_TX/TLS_RX, ...) in user applications
Restrict unprivileged access to network configuration and container/namespace creation capabilities (CAP_NET_ADMIN, unprivileged user namespaces)
Deploy seccomp or AppArmor/SELinux profiles that block untrusted workloads from invoking TLS socket options

bash

# Verify running kernel version and check for the fix
uname -r

# On Debian/Ubuntu: install latest kernel security updates
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/[^-]*-[^-]*-//')

# On RHEL/CentOS/Fedora: update the kernel package
sudo dnf update kernel

# Optionally restrict unprivileged user namespaces as defense-in-depth
sudo sysctl -w kernel.unprivileged_userns_clone=0