CVE-2025-40173
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), ipv6 tunnel yet increases the headroom without any ceiling. Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. Credits to Francesco Ruggeri, who was originally debugging this issue and wrote local Arista-specific patch and a reproducer.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-11-12 11:15:47.780000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-40173",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-11-12T11:15:47.780",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ip6_tunnel: Prevent perpetual tunnel growth\n\nSimilarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too.\nWhile ipv4 tunnel headroom adjustment growth was limited in\ncommit 5ae1e9922bbd (\"net: ip_tunnel: prevent perpetual headroom growth\"),\nipv6 tunnel yet increases the headroom without any ceiling.\n\nReflect ipv4 tunnel headroom adjustment limit on ipv6 version.\n\nCredits to Francesco Ruggeri, who was originally debugging this issue\nand wrote local Arista-specific patch and a reproducer."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/ip6_tunnel: Prevenir el crecimiento perpetuo del túnel\n\nDe manera similar al túnel ipv4, la versión ipv6 también actualiza dev->needed_headroom.\nMientras que el crecimiento del ajuste del headroom del túnel ipv4 fue limitado en el commit 5ae1e9922bbd (“net: ip_tunnel: prevenir el crecimiento perpetuo del headroom”), el túnel ipv6 aún aumenta el headroom sin ningún techo.\n\nReflejar el límite de ajuste del headroom del túnel ipv4 en la versión ipv6.\n\nCréditos a Francesco Ruggeri, quien originalmente estaba depurando este problema y escribió un parche local específico de Arista y un reproductor."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"include/net/ip_tunnels.h",
"net/ipv4/ip_tunnel.c",
"net/ipv6/ip6_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"lessThan": "566f8d5c8a443f2dd69c5460fdec43ed1c870c65",
"versionType": "git",
"status": "affected"
},
{
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"lessThan": "11f6066af3bfb8149aa16c42c0b0c5ea5b199a94",
"versionType": "git",
"status": "affected"
},
{
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"lessThan": "402b6985e872b4cf394bbbf33b503947a326a6cb",
"versionType": "git",
"status": "affected"
},
{
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"lessThan": "10fe967efe73c610e526ff7460581610633dee9c",
"versionType": "git",
"status": "affected"
},
{
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"lessThan": "48294a67863c9cfa367abb66bbf0ef6548ae124f",
"versionType": "git",
"status": "affected"
},
{
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"lessThan": "eeb4345488672584db4f8c20a1ae13a212ce31c4",
"versionType": "git",
"status": "affected"
},
{
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"lessThan": "b6eb25d870f1a8ae571fd3da2244b71df547824b",
"versionType": "git",
"status": "affected"
},
{
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"lessThan": "21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"include/net/ip_tunnels.h",
"net/ipv4/ip_tunnel.c",
"net/ipv6/ip6_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.7",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.7",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.301",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.246",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.196",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.158",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.114",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.55",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.5",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-15T21:57:37.658529Z",
"id": "CVE-2025-40173",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10fe967efe73c610e526ff7460581610633dee9c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/11f6066af3bfb8149aa16c42c0b0c5ea5b199a94",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/402b6985e872b4cf394bbbf33b503947a326a6cb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/48294a67863c9cfa367abb66bbf0ef6548ae124f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/566f8d5c8a443f2dd69c5460fdec43ed1c870c65",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b6eb25d870f1a8ae571fd3da2244b71df547824b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eeb4345488672584db4f8c20a1ae13a212ce31c4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}