FlawAtlas
Search the atlas
CVE-2025-40018 Not scored

ipvs: Defer ip_vs_ftp unregister during netns cleanup

In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.

Exploit probability 0.2%
Published October 24, 2025
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2025:15702-1
related OPENSUSE-SU-2025:20091-1
related OPENSUSE-SU-2026:10301-1
related SUSE-SU-2025:21040-1
related SUSE-SU-2025:21052-1
related SUSE-SU-2025:21056-1
related SUSE-SU-2025:21064-1
related SUSE-SU-2025:21080-1
related SUSE-SU-2025:21147-1
related SUSE-SU-2025:21180-1
related SUSE-SU-2025:4057-1
related SUSE-SU-2025:4111-1
related SUSE-SU-2025:4128-1
related SUSE-SU-2025:4132-1
related SUSE-SU-2025:4135-1
related SUSE-SU-2025:4139-1
related SUSE-SU-2025:4140-1
related SUSE-SU-2025:4141-1
related SUSE-SU-2025:4149-1
related SUSE-SU-2025:4188-1
related SUSE-SU-2025:4189-1
related SUSE-SU-2025:4301-1
related SUSE-SU-2025:4320-1
related SUSE-SU-2026:0352-1
related SUSE-SU-2026:1185-1
related SUSE-SU-2026:1188-1
related SUSE-SU-2026:1212-1
related SUSE-SU-2026:1221-1
related SUSE-SU-2026:1222-1
related SUSE-SU-2026:1225-1
related SUSE-SU-2026:1236-1
related SUSE-SU-2026:1239-1
related SUSE-SU-2026:1242-1
related SUSE-SU-2026:1244-1
related SUSE-SU-2026:1248-1
related SUSE-SU-2026:1259-1
related SUSE-SU-2026:1263-1
related SUSE-SU-2026:1268-1
related SUSE-SU-2026:1269-1
related SUSE-SU-2026:1271-1
related SUSE-SU-2026:1278-1
related SUSE-SU-2026:1280-1
related SUSE-SU-2026:1281-1
related SUSE-SU-2026:1283-1
related SUSE-SU-2026:1285-1
related SUSE-SU-2026:1287-1
related SUSE-SU-2026:1297-1
related SUSE-SU-2026:1298-1
related SUSE-SU-2026:1304-1
related SUSE-SU-2026:21007-1
related SUSE-SU-2026:21008-1
related SUSE-SU-2026:21043-1
related SUSE-SU-2026:21044-1
related SUSE-SU-2026:21045-1
related SUSE-SU-2026:21046-1
related SUSE-SU-2026:21047-1
related SUSE-SU-2026:21048-1
related SUSE-SU-2026:21049-1
related SUSE-SU-2026:21050-1
related SUSE-SU-2026:21053-1
related SUSE-SU-2026:21054-1
related SUSE-SU-2026:21055-1
related SUSE-SU-2026:21056-1
related SUSE-SU-2026:21057-1
related SUSE-SU-2026:21058-1
related SUSE-SU-2026:21059-1
related SUSE-SU-2026:21060-1
related SUSE-SU-2026:21061-1
related SUSE-SU-2026:21073-1
related SUSE-SU-2026:21074-1
related SUSE-SU-2026:21075-1
related SUSE-SU-2026:21076-1
related SUSE-SU-2026:21077-1
related SUSE-SU-2026:21078-1
related SUSE-SU-2026:21079-1
related SUSE-SU-2026:21080-1
related SUSE-SU-2026:21083-1
related SUSE-SU-2026:21084-1
related SUSE-SU-2026:21085-1
related SUSE-SU-2026:21086-1
related SUSE-SU-2026:21087-1
related SUSE-SU-2026:21088-1
related SUSE-SU-2026:21089-1
related SUSE-SU-2026:21090-1
related SUSE-SU-2026:21091-1
related SUSE-SU-2026:21096-1
related SUSE-SU-2026:21099-1
related SUSE-SU-2026:21217-1
related SUSE-SU-2026:21219-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-40018

In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.

View original source

05 / REFERENCES

Further evidence