CVE-2025-40170

In the Linux kernel, the following vulnerability has been resolved:

net: use dst_dev_rcu() in sk_setup_caps()

Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size().

Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward().

ip4_dst_hoplimit() can use dst_dev_net_rcu().

Several paths read dst->dev without RCU. A concurrent dst/device teardown could cause a use-after-free—fixed by switching to dst_dev_rcu() and wrapping sections in rcu_read_lock(), mitigating a local DoS/LPE risk. A local user floods route changes (device up/down, MTU/GSO tweaks, dst churn) while rapidly creating sockets, racing sk_setup_caps() to read dev after free that leads to kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.