Critical Use-After-Free Vulnerability in Linux Kernel (Debian: linux package)
Summary
DEBIAN-CVE-2025-40018: In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting the overall security and functionality of systems running Debian. This specific vulnerability affects the 'linux' package across multiple Debian versions, including Debian 11, 12, 13, and 14.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ipvs module, specifically related to the ip_vs_ftp functionality. During the cleanup of network namespaces (netns), the function __ip_vs_ftp_exit() may unregister ip_vs_ftp before all connections with valid cp->app pointers are flushed. This can lead to a use-after-free condition, potentially allowing an attacker to exploit this flaw to execute arbitrary code or crash the system. The vulnerability is tracked under CVE-2025-40018.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to ensure system security.
Conclusion
The identified vulnerability in the Linux kernel's ipvs module poses significant risks to systems running Debian. It is essential to stay informed about updates and apply patches promptly to maintain system security and integrity.
See every vulnerability recorded for linux →
FAQ
CVE-2025-40018 is a vulnerability in the Linux kernel's ipvs module that can lead to a use-after-free condition during network namespace cleanup.
This vulnerability can potentially allow an attacker to execute arbitrary code or crash the system, compromising its security and stability.
The vulnerability affects Debian versions 11, 12, 13, and 14, specifically the 'linux' package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to monitor for updates and apply them as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
