CVE-2025-40183 (GCVE-0-2025-40183)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:56 – Updated: 2026-08-05 12:08
VLAI
Title
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b4ab31414970a7a03a5d55d75083f2c101a30592 , < 3fba965a9aac0fa3cbd8138436a37af9ab466d79 (git)
Affected: b4ab31414970a7a03a5d55d75083f2c101a30592 , < 057764172fcc6ee2ccb6c41351a55a9f054dc8fd (git)
Affected: b4ab31414970a7a03a5d55d75083f2c101a30592 , < 2e67c2037382abb56497bb9d7b7e10be04eb5598 (git)
Affected: b4ab31414970a7a03a5d55d75083f2c101a30592 , < b6bfe44b6dbb14a31d86c475cdc9c7689534fb09 (git)
Affected: b4ab31414970a7a03a5d55d75083f2c101a30592 , < f36a305d30f557306d87c787ddffe094ac5dac89 (git)
Affected: b4ab31414970a7a03a5d55d75083f2c101a30592 , < 7404ce888a45eb7da0508b7cbbe6f2e95302eeb8 (git)
Affected: b4ab31414970a7a03a5d55d75083f2c101a30592 , < 23f3770e1a53e6c7a553135011f547209e141e72 (git)
Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.157 , ≤ 6.1.* (semver)
Unaffected: 6.6.113 , ≤ 6.6.* (semver)
Unaffected: 6.12.54 , ≤ 6.12.* (semver)
Unaffected: 6.17.4 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3fba965a9aac0fa3cbd8138436a37af9ab466d79",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "057764172fcc6ee2ccb6c41351a55a9f054dc8fd",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "2e67c2037382abb56497bb9d7b7e10be04eb5598",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "b6bfe44b6dbb14a31d86c475cdc9c7689534fb09",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "f36a305d30f557306d87c787ddffe094ac5dac89",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "7404ce888a45eb7da0508b7cbbe6f2e95302eeb8",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            },
            {
              "lessThan": "23f3770e1a53e6c7a553135011f547209e141e72",
              "status": "affected",
              "version": "b4ab31414970a7a03a5d55d75083f2c101a30592",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.157",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.113",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}\n\nCilium has a BPF egress gateway feature which forces outgoing K8s Pod\ntraffic to pass through dedicated egress gateways which then SNAT the\ntraffic in order to interact with stable IPs outside the cluster.\n\nThe traffic is directed to the gateway via vxlan tunnel in collect md\nmode. A recent BPF change utilized the bpf_redirect_neigh() helper to\nforward packets after the arrival and decap on vxlan, which turned out\nover time that the kmalloc-256 slab usage in kernel was ever-increasing.\n\nThe issue was that vxlan allocates the metadata_dst object and attaches\nit through a fake dst entry to the skb. The latter was never released\nthough given bpf_redirect_neigh() was merely setting the new dst entry\nvia skb_dst_set() without dropping an existing one first."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The leak is in the net/core/filter.c datapath and is driven entirely by received packets \u2014 unauthenticated VXLAN/UDP frames decapsulated by a collect-md tunnel attach the metadata_dst that is subsequently orphaned by bpf_redirect_neigh(). A remote sender anywhere on the network can drive the leak at will.\nAC:L - Every packet traversing the tc-BPF redirect path leaks deterministically \u2014 no race, no memory-layout dependence, no timing window. Cilium\u0027s egress-gateway configuration that exposes this is a mainstream, widely deployed Kubernetes setup, and once present the trigger is 100% reliable.\nPR:N - VXLAN collect-md decapsulation performs no authentication of the encapsulated traffic, so the attacker needs no credentials or account on the target \u2014 merely the ability to send packets that transit the gateway. The privileged operation (loading the tc BPF program) is performed by the administrator, not the attacker.\nUI:N - The leak occurs entirely within kernel packet processing on the receive path; no local user or administrator has to take any action for the attacker\u0027s packets to be processed.\nS:U - The orphaned dst objects and pinned netdev references stay within the kernel\u0027s own resource domain on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The metadata_dst is simply never freed \u2014 it is not reused, re-read, or exposed to the attacker, and no out-of-bounds or uninitialized memory is accessed. No information is disclosed.\nI:N - There is no memory corruption, overwrite, or type confusion; the only effect is that a reference is never released, so no kernel or user data is modified.\nA:H - The leak is unbounded and attacker-paced \u2014 256 bytes of kmalloc-256 per redirected packet with no upper limit, so sustained traffic exhausts kernel memory and drives the node into OOM/panic. On paths carrying a real route dst, the leaked reference also pins net_devices, hanging network-namespace teardown indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:23.502Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3fba965a9aac0fa3cbd8138436a37af9ab466d79"
        },
        {
          "url": "https://git.kernel.org/stable/c/057764172fcc6ee2ccb6c41351a55a9f054dc8fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e67c2037382abb56497bb9d7b7e10be04eb5598"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6bfe44b6dbb14a31d86c475cdc9c7689534fb09"
        },
        {
          "url": "https://git.kernel.org/stable/c/f36a305d30f557306d87c787ddffe094ac5dac89"
        },
        {
          "url": "https://git.kernel.org/stable/c/7404ce888a45eb7da0508b7cbbe6f2e95302eeb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/23f3770e1a53e6c7a553135011f547209e141e72"
        }
      ],
      "title": "bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40183",
    "datePublished": "2025-11-12T21:56:27.429Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-08-05T12:08:23.502Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40183",
      "date": "2026-08-12",
      "epss": "0.00587",
      "percentile": "0.45017"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40183\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-12T22:15:45.080\",\"lastModified\":\"2026-07-30T06:24:16.497\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}\\n\\nCilium has a BPF egress gateway feature which forces outgoing K8s Pod\\ntraffic to pass through dedicated egress gateways which then SNAT the\\ntraffic in order to interact with stable IPs outside the cluster.\\n\\nThe traffic is directed to the gateway via vxlan tunnel in collect md\\nmode. A recent BPF change utilized the bpf_redirect_neigh() helper to\\nforward packets after the arrival and decap on vxlan, which turned out\\nover time that the kmalloc-256 slab usage in kernel was ever-increasing.\\n\\nThe issue was that vxlan allocates the metadata_dst object and attaches\\nit through a fake dst entry to the skb. The latter was never released\\nthough given bpf_redirect_neigh() was merely setting the new dst entry\\nvia skb_dst_set() without dropping an existing one first.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/filter.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b4ab31414970a7a03a5d55d75083f2c101a30592\",\"lessThan\":\"3fba965a9aac0fa3cbd8138436a37af9ab466d79\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4ab31414970a7a03a5d55d75083f2c101a30592\",\"lessThan\":\"057764172fcc6ee2ccb6c41351a55a9f054dc8fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4ab31414970a7a03a5d55d75083f2c101a30592\",\"lessThan\":\"2e67c2037382abb56497bb9d7b7e10be04eb5598\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4ab31414970a7a03a5d55d75083f2c101a30592\",\"lessThan\":\"b6bfe44b6dbb14a31d86c475cdc9c7689534fb09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4ab31414970a7a03a5d55d75083f2c101a30592\",\"lessThan\":\"f36a305d30f557306d87c787ddffe094ac5dac89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4ab31414970a7a03a5d55d75083f2c101a30592\",\"lessThan\":\"7404ce888a45eb7da0508b7cbbe6f2e95302eeb8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4ab31414970a7a03a5d55d75083f2c101a30592\",\"lessThan\":\"23f3770e1a53e6c7a553135011f547209e141e72\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/filter.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.246\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.195\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.157\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.113\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.54\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.4\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/057764172fcc6ee2ccb6c41351a55a9f054dc8fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/23f3770e1a53e6c7a553135011f547209e141e72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2e67c2037382abb56497bb9d7b7e10be04eb5598\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3fba965a9aac0fa3cbd8138436a37af9ab466d79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7404ce888a45eb7da0508b7cbbe6f2e95302eeb8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b6bfe44b6dbb14a31d86c475cdc9c7689534fb09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f36a305d30f557306d87c787ddffe094ac5dac89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:08:06+00:00",
      "cve": "CVE-2025-40183",
      "id": "CVE-2025-40183",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40183.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-17T13:06:32Z",
      "cve": "CVE-2025-40183",
      "id": "CVE-2025-40183",
      "initial_release_date": "2025-11-14T00:24:06Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "506",
      "product_status:known_not_affected": "152",
      "product_status:recommended": "500",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40183",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40183.json",
      "version": "38"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.