In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().

Code

The project this record applies to. Exploit listings stay in References.

• Repository · git.kernel.org
• Repository · git.kernel.org
• Repository · git.kernel.org
• Repository · git.kernel.org
• Repository · git.kernel.org

Timeline

Detection, updates, and resolution for this record.

1. Nov 12, 2025 · NIST NVD

   Detected

   In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() i

2. Oct 15, 2026 · NIST NVD

   Updated

   In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() i

Sources

• CVE.orgVulnerability recordCVE-2025-40139

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-40139

  In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_ge

  nvd.nist.gov

References

• Reference · git.kernel.org
• Reference · git.kernel.org
• Reference · git.kernel.org
• Reference · git.kernel.org
• Reference · git.kernel.org