CVE-2025-40256xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists. In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel. There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved. At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work).
Timeline
ID reserved
By Linux
- 8 months later
· 8 months later
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Deferred.
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 1b28a7fae0128fa140a7dccd995182ff6cd1c67b – < 57b72d74d4651dc19d046308a8304eb9abfe66ac
- affected 4b2c17d0f9be8b58bb30468bc81a4b61c985b04e – < 1dad653643f28ccc89be93f9440b8804cded85b2
- affected 0da961fa46da1b37ef868d9b603bd202136f8f8e – < 64441724387b4ac92f67ef51caaaeffe99c950d1
- affected d0e0d1097118461463b76562c7ebaabaa5b90b13 – < 763e5c351206c1e4d910db4a1159053f6263689c
- affected dc3636912d41770466543623cb76e7b88fdb42c7 – < f7d879c19d306512c2e260f37e8a3e5c85e37c50
- affected b441cf3f8c4b8576639d20c8eb4aa32917602ecd – < d6fe5c740c573af10943b8353992e1325cdb2715
- affected b441cf3f8c4b8576639d20c8eb4aa32917602ecd – < 10deb69864840ccf96b00ac2ab3a2055c0c04721
- affected 6.16
- unaffected < 6.16
- unaffected 6.17.10 – ≤ 6.17.*
- unaffected 6.18 – ≤ *
References
References7
- https://git.kernel.org/stable/c/57b72d74d4651dc19d046308a8304eb9abfe66ac (opens in a new tab)
- https://git.kernel.org/stable/c/1dad653643f28ccc89be93f9440b8804cded85b2 (opens in a new tab)
- https://git.kernel.org/stable/c/64441724387b4ac92f67ef51caaaeffe99c950d1 (opens in a new tab)
- https://git.kernel.org/stable/c/763e5c351206c1e4d910db4a1159053f6263689c (opens in a new tab)
- https://git.kernel.org/stable/c/f7d879c19d306512c2e260f37e8a3e5c85e37c50 (opens in a new tab)
- https://git.kernel.org/stable/c/d6fe5c740c573af10943b8353992e1325cdb2715 (opens in a new tab)
- https://git.kernel.org/stable/c/10deb69864840ccf96b00ac2ab3a2055c0c04721 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-201201 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-40256)Record last updated .