CVE-2025-40139smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() is not used in the caller. While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a046d57da19f812216f393e7c535f5858f793ac3 before 5a2fccc4b32c13ddde3676f9e15e1a9baa7d6fde; from a046d57da19f812216f393e7c535f5858f793ac3 before 80d1fd39f4e37d836655e9f7ffccaf78925049bf; from a046d57da19f812216f393e7c535f5858f793ac3 before 956c57daba55cf9ed25d9f2512883b8a1a927599; from a046d57da19f812216f393e7c535f5858f793ac3 before 0736993bfe5c7a9c744ae3fac62d769dfdae54e1; from a046d57da19f812216f393e7c535f5858f793ac3 before 935d783e5de9b64587f3adb25641dd8385e64ddb | CNA record |
References
- https://git.kernel.org/stable/c/5a2fccc4b32c13ddde3676f9e15e1a9baa7d6fde
- https://git.kernel.org/stable/c/80d1fd39f4e37d836655e9f7ffccaf78925049bf
- https://git.kernel.org/stable/c/956c57daba55cf9ed25d9f2512883b8a1a927599
- https://git.kernel.org/stable/c/0736993bfe5c7a9c744ae3fac62d769dfdae54e1
- https://git.kernel.org/stable/c/935d783e5de9b64587f3adb25641dd8385e64ddb
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.