{"id":"CVE-2025-40018","revision":"72d95bbe79e5454f9edf262ecaf94ec4","records":[{"revision":"72d95bbe79e5454f9edf262ecaf94ec4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-40018","aliases":[],"title":"ipvs: Defer ip_vs_ftp unregister during netns cleanup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: Defer ip_vs_ftp unregister during netns cleanup\n\nOn the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp\nbefore connections with valid cp->app pointers are flushed, leading to a\nuse-after-free.\n\nFix this by introducing a global `exiting_module` flag, set to true in\nip_vs_ftp_exit() before unregistering the pernet subsystem. In\n__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns\ncleanup (when exiting_module is false) and defer it to\n__ip_vs_cleanup_batch(), which unregisters all apps after all connections\nare flushed. If called during module exit, unregister ip_vs_ftp\nimmediately.","state":0,"publishedAt":"2025-10-24T11:44:28.955+00:00","modifiedAt":"2026-10-15T22:02:36.226+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/ipvs/ip_vs_ftp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"61b1ab4583e275af216c8454b9256de680499b19\",\n                            \"lessThan\": \"8a6ecab3847c213ce2855b0378e63ce839085de3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"61b1ab4583e275af216c8454b9256de680499b19\",\n                            \"lessThan\": \"421b1ae1574dfdda68b835c15ac4921ec0030182\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"61b1ab4583e275af216c8454b9256de680499b19\",\n                            \"lessThan\": \"1d79471414d7b9424d699afff2aa79fff322f52d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"61b1ab4583e275af216c8454b9256de680499b19\",\n                            \"lessThan\": \"53717f8a4347b78eac6488072ad8e5adbaff38d9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"61b1ab4583e275af216c8454b9256de680499b19\",\n                            \"lessThan\": \"8cbe2a21d85727b66d7c591fd5d83df0d8c4f757\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"61b1ab4583e275af216c8454b9256de680499b19\",\n                            \"lessThan\": \"dc1a481359a72ee7e548f1f5da671282a7c13b8f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"61b1ab4583e275af216c8454b9256de680499b19\",\n                            \"lessThan\": \"a343811ef138a265407167294275201621e9ebb2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"61b1ab4583e275af216c8454b9256de680499b19\",\n                            \"lessThan\": \"134121bfd99a06d44ef5ba15a9beb075297c0821\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/ipvs/ip_vs_ftp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.39\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.39\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.301\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.246\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.195\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.156\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.112\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.53\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17.3\",\n                            \"lessThanOrEqual\": \"6.17.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/8a6ecab3847c213ce2855b0378e63ce839085de3","https://git.kernel.org/stable/c/421b1ae1574dfdda68b835c15ac4921ec0030182","https://git.kernel.org/stable/c/1d79471414d7b9424d699afff2aa79fff322f52d","https://git.kernel.org/stable/c/53717f8a4347b78eac6488072ad8e5adbaff38d9","https://git.kernel.org/stable/c/8cbe2a21d85727b66d7c591fd5d83df0d8c4f757","https://git.kernel.org/stable/c/dc1a481359a72ee7e548f1f5da671282a7c13b8f","https://git.kernel.org/stable/c/a343811ef138a265407167294275201621e9ebb2","https://git.kernel.org/stable/c/134121bfd99a06d44ef5ba15a9beb075297c0821"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40018","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-40018","identifiers":["CVE-2025-40018"]},"retained":false,"historicalAffected":[]}],"coverage":[]}