CVE-2025-40135: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40135 is a vulnerability discovered in the Linux kernel's IPv6 implementation, specifically in the ip6_xmit() function. The vulnerability was disclosed on November 12, 2025, affecting various Linux distributions and their kernel versions. The issue relates to the improper use of RCU (Read-Copy-Update) mechanism in the IPv6 transmission code (NVD Database).

The vulnerability stems from a potential Use-After-Free (UAF) condition in the Linux kernel's IPv6 network stack, specifically in the ip6_xmit() function. The issue arises from not properly using RCU when accessing dst_dev, which could lead to memory safety violations. The fix involves implementing RCU in ip6_xmit() to use dst_dev_rcu() to prevent possible UAF conditions (Debian Tracker).

The vulnerability affects multiple Linux distributions including Debian (bullseye, bookworm, trixie), Ubuntu, and their various kernel versions. In Debian's case, versions up to 6.17.8-1 were vulnerable, with the fix being implemented in version 6.17.9-1 (Debian Tracker).

The vulnerability has been fixed in Linux kernel version 6.17.6-1 and later. Users are advised to upgrade to the patched versions. For Debian systems, the fix is available in version 6.17.9-1, while earlier versions remain vulnerable (Debian Tracker).