CVE-2025-40215: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40215 is a use-after-free / improper resource cleanup vulnerability in the Linux kernel's xfrm (IPsec transform) subsystem, specifically affecting the lifecycle management of IPComp fallback tunnel states. The flaw was published on December 4, 2025, and affects Linux kernel versions from 2.6.29 up to (but not including) the patch introduced in kernel 6.16; Microsoft's Azure Linux 3 packages azl3_kernel_6.6.112.1-2 and azl3_kernel_6.6.117.1-1 are among the confirmed vulnerable products. It carries a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector and high availability impact (Microsoft MSRC, ENISA EUVD).

The root cause is improper resource management (CWE-404 / improper cleanup) in the xfrm subsystem's handling of IPComp fallback tunnel states. When the last user xfrm_state that depends on a fallback tunnel is destroyed, the fallback state is removed from kernel hashtables and lists — but if any remaining references to the user state exist (e.g., from SKBs held on TCP or IP reassembly queues with a secpath), the fallback state lingers on those data structures, triggering a WARN in xfrm_state_fini during network namespace teardown. Prior fixes (commit f75a2804da39) were incomplete because they did not account for all paths where SKBs holding a secpath could outlive xfrm_state_fini. The patch resolves this by explicitly deleting the fallback tunnel state (x->tunnel) at the same time the dependent user state is deleted, rather than waiting for the final reference drop; a separate lockdep class is introduced to safely lock x->tunnel while x is already locked (ENISA EUVD, Kernel Patch).

Successful exploitation causes a kernel warning (WARN) during network namespace destruction, which can lead to a kernel panic or system crash, resulting in a denial of service (high availability impact). There is no confidentiality or integrity impact — the vulnerability cannot be used to read or modify data. The affected scope is limited to the local system; an attacker with low-privileged local access on a system using IPComp-based IPsec tunnels could trigger the condition during netns teardown (Microsoft MSRC, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-40215. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and a specific IPComp/IPsec configuration, significantly limiting the practical attack surface (Microsoft MSRC, ENISA EUVD).

The fix is included in Linux kernel 6.16 and has been backported to stable branches. Downstream distributions have released patched packages, including:

• Debian: linux 6.1.162-1 (oldstable/security) and linux 5.10.249-1 (oldoldstable/security) (Debian LTS)
• Ubuntu: USN-8070-1/2/3, USN-8098-1 through USN-8098-9, USN-8107-1, USN-8112-1/2/4/5, USN-8201-1, USN-8224-1 (Ubuntu Security)
• Amazon Linux 2: ALAS2KERNEL-5.10-2026-113, ALAS2KERNEL-5.15-2026-098 (AWS ALAS)
• Oracle Linux: ELSA-2026-50113, ELSA-2026-50142, ELSA-2026-50234, ELSA-2026-50262
• SUSE: kernel-suse-2026-0350-1
• Microsoft Azure Linux 3: Updated kernel packages superseding azl3_kernel_6.6.112.1-2 and azl3_kernel_6.6.117.1-1

Administrators should apply the relevant kernel update for their distribution. No configuration-based workaround is available; upgrading is the only remediation.