CVE-2025-40075

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The three fixed call sites sit in the core TCP metrics cache, reached from `tcp_conn_request()` on an inbound SYN, from `tcp_finish_connect()`, from the TIME-WAIT/LAST-ACK teardown path, and from TCP Fast Open — all driven purely by packets from a remote peer. No local access is needed to reach the vulnerable code.

AC:HAttack complexity, high

The stale `dst->dev` window only exists while `dst_dev_put()` is concurrently swapping the device to the blackhole netdev during a route removal or NETDEV_DOWN/UNREGISTER event, which a remote attacker cannot induce or time. The attacker controls only the TCP-connection side of the race.

PR:NPrivileges required, none

`tcp_peer_is_proven()` is invoked from `tcp_conn_request()` while processing an unauthenticated SYN, before any application-level credentials exist, and the other paths only require establishing or closing a normal TCP connection. No kernel privilege check or capability gate exists anywhere along the path.

UI:NUser interaction, none

The code runs entirely from softirq/socket context on packet receive and connection teardown; no local user or administrator action is required to trigger it.

S:UScope, unchanged

The unprotected dereference and its consequences are confined to the kernel's own memory and the network stack — the same security authority. There is no VM, IOMMU, or sandbox boundary crossed.

C:HConfidentiality impact, high

A use-after-free read of a released `struct net_device` yields a `struct net` pointer taken from reclaimed memory, which is then used to compute hashes and index the per-namespace metrics cache; attacker-groomed heap contents can be interpreted as kernel structures, enabling disclosure of kernel memory.

I:HIntegrity impact, high

The bogus `struct net` derived from the freed device is stored into `tm->tcpm_net` and drives `tcpm_new()`/`tcpm_suck_dst()` writes, so freed or attacker-controlled memory is treated as a live namespace object — a UAF of this class is leverageable for controlled kernel writes and control-flow hijack.

A:HAvailability impact, high

Dereferencing a freed `net_device` through `dev_net_rcu()` and then using the resulting garbage `struct net` pointer for `net_hash_mix()` and cache lookups leads to an oops or panic, taking down the whole system.