CVE-2025-40215

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: delete x->tunnel as we delete x

The ipcomp fallback tunnels currently get deleted (from the various

lists and hashtables) as the last user state that needed that fallback

is destroyed (not deleted). If a reference to that user state still

exists, the fallback state will remain on the hashtables/lists,

triggering the WARN in xfrm_state_fini. Because of those remaining

references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state

synchronously on net exit path") is not complete.

We recently fixed one such situation in TCP due to defered freeing of

skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we

currently drop dst")). This can also happen due to IP reassembly: skbs

with a secpath remain on the reassembly queue until netns

destruction. If we can't guarantee that the queues are flushed by the

time xfrm_state_fini runs, there may still be references to a (user)

xfrm_state, preventing the

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References