High

Linux kernel net race condition in sk_setup_caps()

IdentifiersCVE-2025-40170CWE-362

A race condition in the Linux kernel networking stack allowed code paths to access dst->dev without RCU protection. The issue was fixed by changing sk_setup_caps() and sk_dst_gso_max_size() to use dst_dev_rcu(), and by applying the same RCU-safe access pattern in ip6_dst_mtu_maybe_forward() and ip_dst_mtu_maybe_forward(); ip4_dst_hoplimit() was updated to use dst_dev_net_rcu(). The flaw indicates unsafe concurrent access to routing-destination device state in networking functions, creating a memory-safety risk during route or device lifetime changes.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation could trigger kernel memory-safety failures and system instability. Available vendor characterizations indicate integrity and availability impact, with likely outcomes including kernel crashes, denial of service, and potentially other corruption arising from concurrent access to stale or invalid network device state. Publicly provided material does not establish reliable remote code execution for this CVE.

Mitigation

If you can’t patch tonight, do this now.

No specific configuration workaround is documented. Until patched kernels can be deployed, reduce exposure by limiting untrusted local access and, where operationally feasible, reducing exposure of affected systems to untrusted or high-volume network traffic. Prioritize patching systems that process attacker-controlled networking workloads.

Remediation

Patch, then assume compromise.

Update to a Linux kernel release that includes the RCU-protected dst->dev access fixes for sk_setup_caps(), sk_dst_gso_max_size(), ip6_dst_mtu_maybe_forward(), ip_dst_mtu_maybe_forward(), and ip4_dst_hoplimit(). Vendor-distributed fixed kernels were released across multiple Red Hat Enterprise Linux and SUSE product streams; apply the relevant kernel security update from the operating system vendor and reboot the system so the new kernel is loaded.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

LinuxLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

28 SOURCESView more in app

redhat accessNews

Jun 22, 2026

RHSA-2026:27731 - Security Advisory - Red Hat Customer Portal

A Linux kernel networking flaw in sk_setup_caps() addressed by using dst_dev_rcu().

redhat accessNews

Jun 17, 2026

RHSA-2026:26515 - Security Advisory - Red Hat Customer Portal

Linux kernel vulnerability in networking code related to use of dst_dev_rcu() in sk_setup_caps().

redhat accessNews

Jun 17, 2026

RHSA-2026:26462 - Security Advisory - Red Hat Customer Portal

Linux kernel vulnerability in networking code related to use of dst_dev_rcu() in sk_setup_caps().

redhat accessNews

Jun 17, 2026

RHSA-2026:26535 - Security Advisory - Red Hat Customer Portal

A Linux kernel networking vulnerability in sk_setup_caps() addressed by using dst_dev_rcu().

+8 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4