In the Linux kernel, the following vulnerability has been resolved:
ipvs: Defer ipvsftp unregister during netns cleanup
On the netns cleanup path, _ipvsftpexit() may unregister ipvsftp before connections with valid cp->app pointers are flushed, leading to a use-after-free.
Fix this by introducing a global exiting_module flag, set to true in
ipvsftpexit() before unregistering the pernet subsystem. In
_ipvsftpexit(), skip ipvsftp unregister if called during netns
cleanup (when exitingmodule is false) and defer it to
_ipvscleanupbatch(), which unregisters all apps after all connections
are flushed. If called during module exit, unregister ipvsftp
immediately.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162343332733378495445366052683120784543",
"147230325442069463996714984069933006101",
"117675328738522649703206278122218495859",
"168554876266494820229705199981824017887",
"80416569260717724460784522285154571748",
"223145430868604547987632423859123286191",
"233175021018771625751185140618257858216",
"88146303958555727622014788820819242736",
"173592327875632951751475624202202340544",
"269536091707355803603576240393005097551",
"141560863332963816277319619051870420498"
]
},
"target": {
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d79471414d7b9424d699afff2aa79fff322f52d",
"signature_version": "v1",
"id": "CVE-2025-40018-066a4c42"
},
{
"digest": {
"length": 133.0,
"function_hash": "133303093496378635520530529881090250081"
},
"target": {
"function": "__ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc1a481359a72ee7e548f1f5da671282a7c13b8f",
"signature_version": "v1",
"id": "CVE-2025-40018-1ad7405a"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162343332733378495445366052683120784543",
"147230325442069463996714984069933006101",
"117675328738522649703206278122218495859",
"168554876266494820229705199981824017887",
"80416569260717724460784522285154571748",
"223145430868604547987632423859123286191",
"233175021018771625751185140618257858216",
"88146303958555727622014788820819242736",
"173592327875632951751475624202202340544",
"269536091707355803603576240393005097551",
"141560863332963816277319619051870420498"
]
},
"target": {
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc1a481359a72ee7e548f1f5da671282a7c13b8f",
"signature_version": "v1",
"id": "CVE-2025-40018-1bbdc394"
},
{
"digest": {
"length": 66.0,
"function_hash": "261825155885328663220958983532561767882"
},
"target": {
"function": "ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a343811ef138a265407167294275201621e9ebb2",
"signature_version": "v1",
"id": "CVE-2025-40018-2d4bfb3f"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162343332733378495445366052683120784543",
"147230325442069463996714984069933006101",
"117675328738522649703206278122218495859",
"168554876266494820229705199981824017887",
"80416569260717724460784522285154571748",
"223145430868604547987632423859123286191",
"233175021018771625751185140618257858216",
"88146303958555727622014788820819242736",
"173592327875632951751475624202202340544",
"269536091707355803603576240393005097551",
"141560863332963816277319619051870420498"
]
},
"target": {
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cbe2a21d85727b66d7c591fd5d83df0d8c4f757",
"signature_version": "v1",
"id": "CVE-2025-40018-3311ac3f"
},
{
"digest": {
"length": 66.0,
"function_hash": "261825155885328663220958983532561767882"
},
"target": {
"function": "ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d79471414d7b9424d699afff2aa79fff322f52d",
"signature_version": "v1",
"id": "CVE-2025-40018-3fe2becc"
},
{
"digest": {
"length": 66.0,
"function_hash": "261825155885328663220958983532561767882"
},
"target": {
"function": "ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cbe2a21d85727b66d7c591fd5d83df0d8c4f757",
"signature_version": "v1",
"id": "CVE-2025-40018-54052aaa"
},
{
"digest": {
"length": 133.0,
"function_hash": "133303093496378635520530529881090250081"
},
"target": {
"function": "__ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53717f8a4347b78eac6488072ad8e5adbaff38d9",
"signature_version": "v1",
"id": "CVE-2025-40018-930f60aa"
},
{
"digest": {
"length": 133.0,
"function_hash": "133303093496378635520530529881090250081"
},
"target": {
"function": "__ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d79471414d7b9424d699afff2aa79fff322f52d",
"signature_version": "v1",
"id": "CVE-2025-40018-a698f073"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162343332733378495445366052683120784543",
"147230325442069463996714984069933006101",
"117675328738522649703206278122218495859",
"168554876266494820229705199981824017887",
"80416569260717724460784522285154571748",
"223145430868604547987632423859123286191",
"233175021018771625751185140618257858216",
"88146303958555727622014788820819242736",
"173592327875632951751475624202202340544",
"269536091707355803603576240393005097551",
"141560863332963816277319619051870420498"
]
},
"target": {
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a343811ef138a265407167294275201621e9ebb2",
"signature_version": "v1",
"id": "CVE-2025-40018-a775ff44"
},
{
"digest": {
"length": 66.0,
"function_hash": "261825155885328663220958983532561767882"
},
"target": {
"function": "ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53717f8a4347b78eac6488072ad8e5adbaff38d9",
"signature_version": "v1",
"id": "CVE-2025-40018-aa242508"
},
{
"digest": {
"length": 66.0,
"function_hash": "261825155885328663220958983532561767882"
},
"target": {
"function": "ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@134121bfd99a06d44ef5ba15a9beb075297c0821",
"signature_version": "v1",
"id": "CVE-2025-40018-b75cb573"
},
{
"digest": {
"length": 133.0,
"function_hash": "133303093496378635520530529881090250081"
},
"target": {
"function": "__ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cbe2a21d85727b66d7c591fd5d83df0d8c4f757",
"signature_version": "v1",
"id": "CVE-2025-40018-be679b99"
},
{
"digest": {
"length": 133.0,
"function_hash": "133303093496378635520530529881090250081"
},
"target": {
"function": "__ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a343811ef138a265407167294275201621e9ebb2",
"signature_version": "v1",
"id": "CVE-2025-40018-c6b3c6af"
},
{
"digest": {
"length": 66.0,
"function_hash": "261825155885328663220958983532561767882"
},
"target": {
"function": "ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc1a481359a72ee7e548f1f5da671282a7c13b8f",
"signature_version": "v1",
"id": "CVE-2025-40018-ca803750"
},
{
"digest": {
"length": 133.0,
"function_hash": "133303093496378635520530529881090250081"
},
"target": {
"function": "__ip_vs_ftp_exit",
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@134121bfd99a06d44ef5ba15a9beb075297c0821",
"signature_version": "v1",
"id": "CVE-2025-40018-df61e189"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162343332733378495445366052683120784543",
"147230325442069463996714984069933006101",
"117675328738522649703206278122218495859",
"168554876266494820229705199981824017887",
"80416569260717724460784522285154571748",
"223145430868604547987632423859123286191",
"233175021018771625751185140618257858216",
"88146303958555727622014788820819242736",
"173592327875632951751475624202202340544",
"269536091707355803603576240393005097551",
"141560863332963816277319619051870420498"
]
},
"target": {
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@134121bfd99a06d44ef5ba15a9beb075297c0821",
"signature_version": "v1",
"id": "CVE-2025-40018-f36d52bf"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162343332733378495445366052683120784543",
"147230325442069463996714984069933006101",
"117675328738522649703206278122218495859",
"168554876266494820229705199981824017887",
"80416569260717724460784522285154571748",
"223145430868604547987632423859123286191",
"233175021018771625751185140618257858216",
"88146303958555727622014788820819242736",
"173592327875632951751475624202202340544",
"269536091707355803603576240393005097551",
"141560863332963816277319619051870420498"
]
},
"target": {
"file": "net/netfilter/ipvs/ip_vs_ftp.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53717f8a4347b78eac6488072ad8e5adbaff38d9",
"signature_version": "v1",
"id": "CVE-2025-40018-f6c166ef"
}
]