CVE-2025-40075

The vulnerability resides in the tcp_metrics subsystem of the Linux kernel. The code used the dst_dev() function without appropriate RCU lockdep annotation, which could lead to missing or false-positive lockdep warnings. The fix replaces three instances of dst_dev() with the lockdep-enabled helper dst_dev_net_rcu(), ensuring proper lock class tracking.

Exploitation requires triggering the code paths that invoke dst_dev() within tcp_metrics. An attacker with network access could potentially induce such paths by sending crafted network traffic that causes the kernel to evaluate tcp_metrics, though the specific prerequisites are minimal beyond general network reachability.

The primary impact is on system stability and debugging accuracy. Improper lockdep annotations can cause lockdep to either miss real locking bugs or report spurious warnings, potentially leading to undetected deadlocks or system crashes in production environments.

The fix has been committed to the Linux kernel stable tree as commit 50c127a69cd6. Users are advised to update to a kernel version containing this commit to ensure correct lockdep behavior.