CVE-2025-40256: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40256 is a memory leak (resource leak) vulnerability in the Linux kernel's XFRM (IPsec transform) subsystem, specifically in the handling of IPcomp tunnel state lifecycle management. The flaw was introduced by an incomplete fix in commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x") that missed the case where state creation fails after ->init_state is called but before the state is inserted into the kernel's state lists. Affected Linux kernel versions span from commit b441cf3f8c4b up to (but not including) the fix commits; patched versions include kernel 6.17.10 and 6.18. It was published on December 4, 2025, with an estimated CVSS severity of Medium and an EPSS score of approximately 0.024% (Feedly, ENISA EUVD).

The root cause is a resource management error (CWE-401: Missing Release of Memory after Effective Lifetime) in the Linux kernel's xfrm_state_gc_destroy function. When an IPcomp state's ->init_state callback is invoked, it creates a fallback (FB) tunnel and registers it on the kernel's XFRM state lists. If state creation subsequently fails before the user state is inserted into those lists, the user state bypasses __xfrm_state_delete, meaning xfrm_state_delete_tunnel is never called for it, and the FB tunnel is leaked. The fix ensures xfrm_state_delete_tunnel is also called during xfrm_state_gc_destroy for states that were never added to the lists, covering affected codepaths in net/key, xfrm add/update paths, and the migrate code (xfrm_migrate, xfrm_state_migrate) (Feedly, ENISA EUVD).

Successful triggering of this vulnerability results in a kernel memory leak — specifically, the fallback IPcomp tunnel state is never freed, gradually consuming kernel memory resources. Over time or under repeated triggering, this could degrade system performance or contribute to denial-of-service conditions due to resource exhaustion. There is no direct confidentiality or integrity impact; the primary risk is availability degradation on systems using IPcomp tunnels (Feedly).

There is no known public proof-of-concept exploit or evidence of in-the-wild exploitation for CVE-2025-40256. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term (Feedly). Exploitation would require local access to a system with IPcomp tunnel configuration capabilities, significantly limiting the attack surface.

The fix has been applied to the Linux kernel stable trees; patched versions include kernel 6.17.10 and 6.18 (ENISA EUVD). Downstream distributions including SUSE, Oracle Linux (versions 7, 8, and 9), and others have issued updated kernel packages incorporating this fix (Feedly). Administrators should update to the latest available kernel version for their distribution. No configuration-based workaround is available; upgrading is the recommended remediation.