CVE-2025-40018 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.
A use-after-free vulnerability has been identified in the Linux kernel's IP Virtual Server (IPVS) FTP module. During network namespace cleanup, the module's exit function may unregister FTP handling before all connections are properly flushed, particularly those with valid application pointers. This flaw can be exploited to access freed memory, potentially leading to arbitrary code execution or other memory corruption issues. The vulnerability affects several versions of the Linux kernel.
The vulnerability has been addressed by introducing a global 'exiting_module' flag. This flag is set to true in the module's exit function before unregistering the per-network namespace subsystem. The unregistration process is now deferred until all connections are flushed, preventing the use-after-free condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/134121bfd99a06d44ef5ba15a9beb075297c0821 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/1d79471414d7b9424d699afff2aa79fff322f52d | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/421b1ae1574dfdda68b835c15ac4921ec0030182 | kernel.org | |
| https://git.kernel.org/stable/c/53717f8a4347b78eac6488072ad8e5adbaff38d9 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/8a6ecab3847c213ce2855b0378e63ce839085de3 | kernel.org | |
| https://git.kernel.org/stable/c/8cbe2a21d85727b66d7c591fd5d83df0d8c4f757 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/a343811ef138a265407167294275201621e9ebb2 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/dc1a481359a72ee7e548f1f5da671282a7c13b8f | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Oct 29, 2025 | CVE Modified | kernel.org |
| Oct 24, 2025 | New CVE Received | kernel.org |