Loading vulnerability…
Use-after-free in Linux kernel SMC prefix matching
CVE-2025-40168 is a use-after-free vulnerability in the Linux kernel Shared Memory Communications (SMC) subsystem. The smc_clc_prfx_match() function is invoked by smc_listen_work() without RCU or RTNL protection. Accessing the destination's network device through sk_dst_get(sk)->dev in this context can dereference freed memory. The fix changes destination and device access to use __sk_dst_get() and dst_dev_rcu(). Although the caller ignores the function's return value, the unsafe memory access still occurs.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Triggering the use-after-free can compromise kernel memory safety, potentially causing kernel instability, crashes, and denial of service. SUSE assesses the vulnerability as locally exploitable by a low-privileged attacker, with integrity and availability impacts. Privilege escalation is a potential consequence, but a reliable escalation mechanism is not established.
If you can’t patch tonight, do this now.
No confirmed vulnerability-specific workaround is available. Until patching is possible, restrict untrusted local access and access to applications using SMC, and minimize exposure of SMC listeners. These measures reduce attack surface but do not correct the underlying memory-lifetime defect.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the fix to use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(), then reboot into the corrected kernel. Fixed builds include Debian trixie Linux 6.12.111-1, RHEL 8 kernel 4.18.0-553.105.1.el8_10, RHEL 10.0 EUS kernel 6.12.0-55.63.1.el10_0, and SUSE Linux Enterprise 15 SP7 kernel-default 6.4.0-150700.53.25.1. Use the applicable fixed build or a later supported update for the installed product and support channel.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.