CVE-2025-40018

In the Linux kernel, the following vulnerability has been resolved:

ipvs: Defer ip_vs_ftp unregister during netns cleanup

On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free.

Fix this by introducing a global exiting_module flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.

IPVS FTP helper could be unregistered during netns cleanup while connections still held valid cp->app pointers, leading to a use-after-free when those connections were later processed. A local privileged actor (able to manage IPVS and network namespaces) could trigger a kernel crash or memory corruption. The fix introduces an exiting_module guard and defers unregistering the helper to the batch cleanup after all connections are flushed, while keeping immediate unregister on module exit. Keep Moderate impact rating — exploitation requires local privileged access (root or CAP_NET_ADMIN to manage IPVS / network namespaces), so it is unlikely that an unprivileged local user can trigger this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.