CVE-2025-40363

A fortify-source warning was found in the IPv6 AH (Authentication Header) implementation in the Linux kernel. The memcpy operations in ah6_output() copy 40 bytes into a 16-byte address field, which triggers FORTIFY_SOURCE warnings. While intentional (copying header plus extensions), this pattern could mask real buffer overflows.

This is primarily a code quality issue flagged by FORTIFY_SOURCE hardening. The memcpy is intentional but uses incorrect field references. The fix separates address and extension header copies properly.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.