CVE-2025-40091— ixgbe: fix too early devlink_free() in ixgbe_remove()
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-40091
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ixgbe: fix too early devlink_free() in ixgbe_remove()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix too early devlink_free() in ixgbe_remove() Since ixgbe_adapter is embedded in devlink, calling devlink_free() prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free() to the end. KASAN report: BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] Read of size 8 at addr ffff0000adf813e0 by task bash/2095 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) [...] Call trace: show_stack+0x30/0x90 (C) dump_stack_lvl+0x9c/0xd0 print_address_description.constprop.0+0x90/0x310 print_report+0x104/0x1f0 kasan_report+0x88/0x180 __asan_report_load8_noabort+0x20/0x30 ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe] ixgbe_remove+0x2d0/0x8c0 [ixgbe] pci_device_remove+0xa0/0x220 device_remove+0xb8/0x170 device_release_driver_internal+0x318/0x490 device_driver_detach+0x40/0x68 unbind_store+0xec/0x118 drv_attr_store+0x64/0xb8 sysfs_kf_write+0xcc/0x138 kernfs_fop_write_iter+0x294/0x440 new_sync_write+0x1fc/0x588 vfs_write+0x480/0x6a0 ksys_write+0xf0/0x1e0 __arm64_sys_write+0x70/0xc0 invoke_syscall.constprop.0+0xcc/0x280 el0_svc_common.constprop.0+0xa8/0x248 do_el0_svc+0x44/0x68 el0_svc+0x54/0x160 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ixgbe_remove函数中过早调用devlink_free，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-40091
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-40091
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-10-30 · 20 CVEs total
| CVE-2025-40096 | drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies | |
| CVE-2025-40105 | vfs: Don't leak disconnected dentries on umount | |
| CVE-2025-40104 | ixgbevf: fix mailbox API compatibility by negotiating supported features | |
| CVE-2025-40103 | smb: client: Fix refcount leak for cifs_sb_tlink | |
| CVE-2025-40102 | KVM: arm64: Prevent access to vCPU events before init | |
| CVE-2025-40100 | btrfs: do not assert we found block group item when creating free space tree | |
| CVE-2025-40101 | btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST | |
| CVE-2025-40099 | cifs: parse_dfs_referrals: prevent oob on malformed input | |
| CVE-2025-40098 | ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() | |
| CVE-2025-40097 | ALSA: hda: Fix missing pointer check in hda_component_manager_init function | |
| CVE-2025-40086 | drm/xe: Don't allow evicting of BOs in same VM in array of VM binds | |
| CVE-2025-40095 | usb: gadget: f_rndis: Refactor bind path to use __free() | |
| CVE-2025-40094 | usb: gadget: f_acm: Refactor bind path to use __free() | |
| CVE-2025-40093 | usb: gadget: f_ecm: Refactor bind path to use __free() | |
| CVE-2025-40092 | usb: gadget: f_ncm: Refactor bind path to use __free() | |
| CVE-2025-40090 | ksmbd: fix recursive locking in RPC handle list access | |
| CVE-2025-40089 | cxl/features: Add check for no entries in cxl_feature_info | |
| CVE-2025-40088 | hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() | |
| CVE-2025-40087 | NFSD: Define a proc_layoutcommit for the FlexFiles layout type |
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2025-40091
No comments yet