CVE-2025-40183

A metadata structure leak was found in the Linux kernel's BPF redirect neighbor helper functions for both IPv4 and IPv6. A local user running BPF programs can trigger this issue when redirecting packets that already have metadata_dst objects attached (such as vxlan decapsulated packets), causing the helper to overwrite the existing destination entry without releasing it first. This creates permanent memory leaks that accumulate over time, leading to resource exhaustion and denial of service.

When vxlan decapsulates packets, it attaches metadata_dst objects via fake dst entries. The bpf_redirect_neigh helper then calls skb_dst_set to attach its own dst for the redirect, but never drops the existing reference first. Each redirect leaks the vxlan metadata_dst. This manifests in Cilium's egress gateway feature where pod traffic flows through vxlan tunnels then gets BPF-redirected—kmalloc-256 slab usage grows continuously as leaked structures accumulate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.