CVE-2025-40170: Linux

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward(). ip4_dst_hoplimit() can use dst_dev_net_rcu().

Affected products

• Linux Linux: from 4.13, before 6.12.64 (fixed in 6.12.64); from 6.13, before 6.17.3 (fixed in 6.17.3)

Published 2025-11-12. Last modified 2026-07-30.