CVE-2025-40064

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

smc: Fix use-after-free in __pnet_find_base_ndev().

syzbot reported use-after-free of net_device in __pnet_find_base_ndev(),

which was called during connect(). [0]

smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes

down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened

at __pnet_find_base_ndev() when the dev is first used.

This means dev had already been freed before acquiring RTNL in

pnet_find_base_ndev().

While dev is going away, dst->dev could be swapped with blackhole_netdev,

and the dev's refcnt by dst will be released.

We must hold dev's refcnt before calling smc_pnet_find_ism_resource().

Also, smc_pnet_find_roce_resource() has the same problem.

Let's use __sk_dst_get() and dst_dev_rcu() in the two functions.

[0]:

BUG: KASAN: use-after-free in __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926

Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609

CPU: 1

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References