Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/kaleth4/cve-2025-40271
Vulnerability AnalysisExploitationPapers & ResearchLearning & EducationBinary Exploitation
GitHubkaleth4/cve-2025-40271

CVE-2025-40271

Technical analysis of CVE-2025-40271, a critical Use-After-Free vulnerability in the Linux kernel's /proc filesystem, including root cause, reproduction steps, and patch details.

View Repository
14 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🔴 CVE-2025-40271: Critical Use-After-Free Vulnerability in the Linux Kernel

🛡️ Vulnerability Details

CVE-2025-40271 is a critical Use-After-Free (UAF) vulnerability affecting the /proc filesystem of the Linux kernel. The flaw resides in the proc_readdir_de() function, responsible for listing the contents of directories within /proc.

🔍 The Problem

When a directory entry (PDE) is removed from the red-black tree (rbtree) via rb_erase(), the kernel did not mark the node as empty. This creates a dangerous scenario:

  • If a process is reading a directory (e.g. /proc/pid/net/dev_snmp6/) while another removes network interfaces (such as tun devices), the pointer may end up pointing to .
already freed memory
  • When trying to access the next node in the tree, the kernel uses invalid memory, causing:
    • Kernel Panic (system crash).
    • Possible malicious code execution (if an attacker exploits the race condition).

    • 📊 Status and Metrics

    FieldDetail
    IDCVE-2025-40271
    ComponentLinux Kernel (fs/proc)
    SeverityHigh (though not yet officially scored by NVD/NIST)
    OriginDetected with stress-ng (simultaneous getdent and tun cases)
    NVD StatusNot prioritized for enrichment (limited resources)

    🛠️ Solution (Patch)

    The kernel development team implemented a critical patch that replaces node handling with RB_CLEAR_NODE(). This ensures that:

    • When deleting a node from the tree, any read attempt returns NULL instead of a pointer to freed memory.
    • Prevents the UAF by properly invalidating the node.

    📌 Patched Kernel Versions

    The patch is already available in the following stable branches:

    • 6.1.x
    • 6.6.x
    • 6.12.x
    • 6.13.x

    🔗 Official References (Git Kernel.org)

    To review the exact patch code, see these commits:

    • Commit 03de7ff
    • Commit 6f24827

    📜 Technical Description (NIST)

    "In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de(). PDE is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in UAF access. We should use RB_CLEAR_NODE() to set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid UAF access."

    🔄 Steps to Reproduce the Problem

    1. Process 1: Uses getdent to traverse /proc/pid/net/dev_snmp6/ (the current pointer is tun3).
    2. Process 2: In a critical time window, unregisters network devices (tun3 and tun2), removing them from the tree.
      • First tun3 is removed, then tun2 (freed to the slab).
    3. Process 1: Continues traversal with getdent, but pde_subdir_next() returns tun2 (already freed), causing UAF.

    📊 Weakness Enumeration and Metrics

    CWE-IDNameSource
    CWE-416Use After FreeNVD

    🔗 Useful Links

    URLDescription
    NVD - CVE-2025-40271Official details (still without CVSS score)
    Kernel.org CommitsSource code of patches

    ⚠️ Final Recommendation: If you use kernel versions 6.1.x, 6.6.x, 6.12.x or 6.13.x, update immediately to a patched version. If not possible, consider applying the commits manually or restricting access to /proc via security policies (e.g. chroot, SELinux).

    Download Tool