CVE-2025-40149

A flaw was found in the Linux kernel’s TLS implementation (net/tls/tls_device.c). The function get_netdev_for_sock() is invoked during setsockopt(), which is not executed under RCU (Read-Copy-Update) protection. It previously used sk_dst_get(sk)->dev, which can lead to a use-after-free (UAF) if the sk’s destination is freed

This vulnerability is rated as Moderate impact because exploiting this race condition requires local socket manipulation and specific timing to trigger the use-after-free condition, typically leading to a system crash (denial of service) rather than arbitrary code execution. In Red Hat Enterprise Linux, kernel TLS device offload functionality is not widely enabled by default and requires explicit socket configuration by local processes. Consequently, the practical risk is constrained to local denial of service under specific concurrency conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.