- 7.8HighCVSS base score
- 0.49%Exploitation in 30 daysEPSS · top 57% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 1Public exploitsMetasploit, Nuclei and Exploit-DB
Description
In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2)
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list an Exploit-DB entry for it.
Show the exploits1
Exploit-DB1 entry
- Linux Kernel proc_readdir_de() 6.18-rc5 - Local Privilege Escalation (Exploit-DB entry) (opens in a new tab)
EDB-ID 52550local, linuxpublished 4 May 2026Not verified
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By Linux
- 8 months later
· 8 months later
Published
- 8 months later
· 8 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.49% · top 57% of all CVEs (11 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 710585d4922fd315f2cada8fbe550ae8ed23e994 – < 1d1596d68a6f11d28f677eedf6cf5b17dbfeb491
- affected 710585d4922fd315f2cada8fbe550ae8ed23e994 – < c81d0385500446efe48c305bbb83d47f2ae23a50
- affected 710585d4922fd315f2cada8fbe550ae8ed23e994 – < 4cba73c4c89219beef7685a47374bf88b1022369
- affected 710585d4922fd315f2cada8fbe550ae8ed23e994 – < 6f2482745e510ae1dacc9b090194b9c5f918d774
- affected 710585d4922fd315f2cada8fbe550ae8ed23e994 – < 67272c11f379d9aa5e0f6b16286b9d89b3f76046
- affected 710585d4922fd315f2cada8fbe550ae8ed23e994 – < 623bb26127fb581a741e880e1e1a47d79aecb6f8
- affected 710585d4922fd315f2cada8fbe550ae8ed23e994 – < 03de7ff197a3d0e17d0d5c58fdac99a63cba8110
- affected 710585d4922fd315f2cada8fbe550ae8ed23e994 – < 895b4c0c79b092d732544011c3cecaf7322c36a1
- affected 3.19
- unaffected < 3.19
- unaffected 5.4.302 – ≤ 5.4.*
- unaffected 5.10.247 – ≤ 5.10.*
- unaffected 5.15.197 – ≤ 5.15.*
- unaffected 6.1.159 – ≤ 6.1.*
- unaffected 6.6.117 – ≤ 6.6.*
- unaffected 6.12.59 – ≤ 6.12.*
- unaffected 6.17.9 – ≤ 6.17.*
- unaffected 6.18 – ≤ *
References
References9
- https://git.kernel.org/stable/c/1d1596d68a6f11d28f677eedf6cf5b17dbfeb491 (opens in a new tab)
- https://git.kernel.org/stable/c/c81d0385500446efe48c305bbb83d47f2ae23a50 (opens in a new tab)
- https://git.kernel.org/stable/c/4cba73c4c89219beef7685a47374bf88b1022369 (opens in a new tab)
- https://git.kernel.org/stable/c/6f2482745e510ae1dacc9b090194b9c5f918d774 (opens in a new tab)
- https://git.kernel.org/stable/c/67272c11f379d9aa5e0f6b16286b9d89b3f76046 (opens in a new tab)
- https://git.kernel.org/stable/c/623bb26127fb581a741e880e1e1a47d79aecb6f8 (opens in a new tab)
- https://git.kernel.org/stable/c/03de7ff197a3d0e17d0d5c58fdac99a63cba8110 (opens in a new tab)
- https://git.kernel.org/stable/c/895b4c0c79b092d732544011c3cecaf7322c36a1 (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-201584 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-40271)Record last updated .