CVE-2025-40149

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-40149
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40149.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-40149
Downstream
Related
Published
2025-11-12T10:23:27.122Z
Modified
2026-05-07T04:16:42.628093Z
Summary
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
Details

In the Linux kernel, the following vulnerability has been resolved:

tls: Use _skdstget() and dstdevrcu() in getnetdevforsock().

getnetdevfor_sock() is called during setsockopt(), so not under RCU.

Using skdstget(sk)->dev could trigger UAF.

Let's use __skdstget() and dstdevrcu().

Note that the only ->ndoskgetlowerdev() user is bondskgetlowerdev(), which uses RCU.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40149.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e8f69799810c32dd40c6724d829eccc70baad07f
Fixed
2b1bef126bbb8d0da51491357559126d567c1dee
Fixed
e37ca0092ddace60833790b4ad7a390408fb1be9
Fixed
13159c7125636371543a82cb7bbae00ab36730cc
Fixed
f09cd209359a23f88d4f3fa3d2379d057027e53c
Fixed
feb474ddbf26b51f462ae2e60a12013bdcfc5407
Fixed
c65f27b9c3be2269918e1cbad6d8884741f835c5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40149.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.18.0
Fixed
5.15.199
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.161
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.121
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.66
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.17.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40149.json"