CVE-2025-40018: Linux

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.

Affected products

• Linux Linux: from 2.6.39, before 5.4.301 (fixed in 5.4.301); from 5.5, before 5.10.246 (fixed in 5.10.246); from 5.11, before 5.15.195 (fixed in 5.15.195); from 5.16, before 6.1.156 (fixed in 6.1.156); from 6.2, before 6.6.112 (fixed in 6.6.112); from 6.7, before 6.12.53 (fixed in 6.12.53); …

Published 2025-10-24. Last modified 2026-07-30.