CVE-2025-40173

Vulnerability

Description

CVE-2025-40173 is a vulnerability in the Linux kernel's IPv6 tunnel implementation (net/ip6_tunnel). Similar to a previously fixed issue in IPv4 tunnels (commit 5ae1e9922bbd), the IPv6 version updates dev->needed_headroom without any limit, leading to perpetual headroom growth [1]. This unbounded growth can exhaust kernel memory or degrade network performance, resulting in a denial-of-service condition.

Exploitation

The vulnerability is triggered by repeatedly creating or reconfiguring IPv6 tunnels, which causes ip6_tnl_change to increase the headroom requirement without bound [2]. No special privileges are required beyond the ability to create or modify network tunnels (typically CAP_NET_ADMIN). An attacker with local access can exploit this to cause resource exhaustion.

Impact

Successful exploitation leads to continuous headroom expansion, potentially exhausting system memory or causing network stack failures. This can result in denial of service for the affected system and its network services.

Mitigation

The fix limits the headroom increase, mirroring the IPv4 tunnel fix [3]. Patches have been applied to the Linux kernel stable branches [4]. Users should update to the latest stable kernel to prevent exploitation.