---
id: CVE-2025-40074
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: start using dst_dev_rcu()

  Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.

  Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),
  i…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: start using dst_dev_rcu()

  Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.

  Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),
  i…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 <
    e150f273cd8ed34ebc6d03758aad95c12fc58337
  - >-
    Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 <
    684efb2c86c887685f9aa65e1a21b3df6c1f822d
  - >-
    Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 <
    923e0734c386984d45de508528a7a7ad91d791cc
  - >-
    Linux >= 4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36 <
    6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8
  - Linux 4.13
published: '2025-10-28'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T12:17:37.307'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-40074'
references:
  - url: 'https://git.kernel.org/stable/c/684efb2c86c887685f9aa65e1a21b3df6c1f822d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/923e0734c386984d45de508528a7a7ad91d791cc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e150f273cd8ed34ebc6d03758aad95c12fc58337'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.0043
epssPercentile: 0.34505
ingestedAt: '2026-08-27T14:02:52.841Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv4: start using dst_dev_rcu()

Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.

Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),
ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.