UBUNTU-CVE-2025-40215
In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete. We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state. Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped. A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked.
02 / AFFECTED SOFTWARE
Affected packages
10 explicit affected versions
7 explicit affected versions
12 explicit affected versions
11 explicit affected versions
37 explicit affected versions
126 explicit affected versions
85 explicit affected versions
1 explicit affected versions
10 explicit affected versions
7 explicit affected versions
37 explicit affected versions
13 explicit affected versions
28 explicit affected versions
111 explicit affected versions
83 explicit affected versions
87 explicit affected versions
10 explicit affected versions
13 explicit affected versions
26 explicit affected versions
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
79 explicit affected versions
71 explicit affected versions
8 explicit affected versions
36 explicit affected versions
3 explicit affected versions
11 explicit affected versions
47 explicit affected versions
110 explicit affected versions
78 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
10 explicit affected versions
6 explicit affected versions
88 explicit affected versions
24 explicit affected versions
73 explicit affected versions
73 explicit affected versions
85 explicit affected versions
79 explicit affected versions
68 explicit affected versions
26 explicit affected versions
80 explicit affected versions
191 explicit affected versions
7 explicit affected versions
35 explicit affected versions
77 explicit affected versions
32 explicit affected versions
13 explicit affected versions
79 explicit affected versions
35 explicit affected versions
35 explicit affected versions
40 explicit affected versions
38 explicit affected versions
18 explicit affected versions
1 explicit affected versions
21 explicit affected versions
64 explicit affected versions
37 explicit affected versions
115 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
116 explicit affected versions
43 explicit affected versions
118 explicit affected versions
1 explicit affected versions
9 explicit affected versions
16 explicit affected versions
10 explicit affected versions
69 explicit affected versions
39 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
14 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
9 explicit affected versions
99 explicit affected versions
12 explicit affected versions
183 explicit affected versions
101 explicit affected versions
12 explicit affected versions
32 explicit affected versions
115 explicit affected versions
34 explicit affected versions
16 explicit affected versions
23 explicit affected versions
25 explicit affected versions
10 explicit affected versions
10 explicit affected versions
13 explicit affected versions
31 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
55 explicit affected versions
1 explicit affected versions
26 explicit affected versions
3 explicit affected versions
13 explicit affected versions
27 explicit affected versions
1 explicit affected versions
29 explicit affected versions
105 explicit affected versions
13 explicit affected versions
12 explicit affected versions
85 explicit affected versions
32 explicit affected versions
32 explicit affected versions
1 explicit affected versions
96 explicit affected versions
80 explicit affected versions
10 explicit affected versions
11 explicit affected versions
43 explicit affected versions
33 explicit affected versions
23 explicit affected versions
49 explicit affected versions
10 explicit affected versions
109 explicit affected versions
11 explicit affected versions
5 explicit affected versions
146 explicit affected versions
12 explicit affected versions
132 explicit affected versions
7 explicit affected versions
12 explicit affected versions
2 explicit affected versions
5 explicit affected versions
65 explicit affected versions
124 explicit affected versions
81 explicit affected versions
160 explicit affected versions
10 explicit affected versions
26 explicit affected versions
31 explicit affected versions
1 explicit affected versions
57 explicit affected versions
26 explicit affected versions
38 explicit affected versions
11 explicit affected versions
13 explicit affected versions
37 explicit affected versions
132 explicit affected versions
73 explicit affected versions
16 explicit affected versions
79 explicit affected versions
41 explicit affected versions
86 explicit affected versions
1 explicit affected versions
7 explicit affected versions
2 explicit affected versions
51 explicit affected versions
18 explicit affected versions
33 explicit affected versions
12 explicit affected versions
66 explicit affected versions
68 explicit affected versions
27 explicit affected versions
54 explicit affected versions
115 explicit affected versions
1 explicit affected versions
1 explicit affected versions
90 explicit affected versions
34 explicit affected versions
8 explicit affected versions
45 explicit affected versions
5 explicit affected versions
8 explicit affected versions
104 explicit affected versions
13 explicit affected versions
66 explicit affected versions
7 explicit affected versions
8 explicit affected versions
12 explicit affected versions
9 explicit affected versions
28 explicit affected versions
103 explicit affected versions
75 explicit affected versions
50 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
45 explicit affected versions
37 explicit affected versions
42 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
11 explicit affected versions
30 explicit affected versions
13 explicit affected versions
81 explicit affected versions
8 explicit affected versions
7 explicit affected versions
92 explicit affected versions
136 explicit affected versions
115 explicit affected versions
4 explicit affected versions
70 explicit affected versions
106 explicit affected versions
70 explicit affected versions
69 explicit affected versions
13 explicit affected versions
43 explicit affected versions
139 explicit affected versions
113 explicit affected versions
160 explicit affected versions
10 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
11 explicit affected versions
1 explicit affected versions
62 explicit affected versions
117 explicit affected versions
10 explicit affected versions
30 explicit affected versions
69 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete. We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state. Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped. A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/b441cf3f8c4b8576639d20c8eb4aa32917602ecd
- https://git.kernel.org/stable/c/b441cf3f8c4b8576639d20c8eb4aa32917602ecd
- https://ubuntu.com/security/CVE-2025-40215
- https://ubuntu.com/security/notices/USN-8028-1
- https://ubuntu.com/security/notices/USN-8028-2
- https://ubuntu.com/security/notices/USN-8028-3
- https://ubuntu.com/security/notices/USN-8028-4
- https://ubuntu.com/security/notices/USN-8028-5
- https://ubuntu.com/security/notices/USN-8028-6
- https://ubuntu.com/security/notices/USN-8028-7
- https://ubuntu.com/security/notices/USN-8028-8
- https://ubuntu.com/security/notices/USN-8031-1
- https://ubuntu.com/security/notices/USN-8031-2
- https://ubuntu.com/security/notices/USN-8031-3
- https://ubuntu.com/security/notices/USN-8033-1
- https://ubuntu.com/security/notices/USN-8033-2
- https://ubuntu.com/security/notices/USN-8033-3
- https://ubuntu.com/security/notices/USN-8033-4
- https://ubuntu.com/security/notices/USN-8033-5
- https://ubuntu.com/security/notices/USN-8033-6
- https://ubuntu.com/security/notices/USN-8033-7
- https://ubuntu.com/security/notices/USN-8033-8
- https://ubuntu.com/security/notices/USN-8034-1
- https://ubuntu.com/security/notices/USN-8034-2
- https://ubuntu.com/security/notices/USN-8052-1
- https://ubuntu.com/security/notices/USN-8052-2
- https://ubuntu.com/security/notices/USN-8070-1
- https://ubuntu.com/security/notices/USN-8070-2
- https://ubuntu.com/security/notices/USN-8070-3
- https://ubuntu.com/security/notices/USN-8074-1
- https://ubuntu.com/security/notices/USN-8074-2
- https://ubuntu.com/security/notices/USN-8098-1
- https://ubuntu.com/security/notices/USN-8098-10
- https://ubuntu.com/security/notices/USN-8098-2
- https://ubuntu.com/security/notices/USN-8098-3
- https://ubuntu.com/security/notices/USN-8098-4
- https://ubuntu.com/security/notices/USN-8098-5
- https://ubuntu.com/security/notices/USN-8098-6
- https://ubuntu.com/security/notices/USN-8098-7
- https://ubuntu.com/security/notices/USN-8098-8
- https://ubuntu.com/security/notices/USN-8098-9
- https://ubuntu.com/security/notices/USN-8107-1
- https://ubuntu.com/security/notices/USN-8112-1
- https://ubuntu.com/security/notices/USN-8112-2
- https://ubuntu.com/security/notices/USN-8112-3
- https://ubuntu.com/security/notices/USN-8112-4
- https://ubuntu.com/security/notices/USN-8112-5
- https://ubuntu.com/security/notices/USN-8126-1
- https://ubuntu.com/security/notices/USN-8141-1
- https://ubuntu.com/security/notices/USN-8163-1
- https://ubuntu.com/security/notices/USN-8163-2
- https://ubuntu.com/security/notices/USN-8201-1
- https://ubuntu.com/security/notices/USN-8224-1
- https://ubuntu.com/security/notices/USN-8243-1
- https://www.cve.org/CVERecord?id=CVE-2025-40215