CVE-2025-40271

🔴 CVE-2025-40271: Critical Use-After-Free Vulnerability in the Linux Kernel

---

🛡️ Vulnerability Details

CVE-2025-40271 is a critical Use-After-Free (UAF) vulnerability affecting the /proc filesystem of the Linux kernel. The flaw resides in the proc_readdir_de() function, responsible for listing the contents of directories within /proc.

🔍 The Problem

When a directory entry (PDE) is removed from the red-black tree (rbtree) via rb_erase(), the kernel did not mark the node as empty. This creates a dangerous scenario:

• If a process is reading a directory (e.g. /proc/pid/net/dev_snmp6/) while another removes network interfaces (such as tun devices), the pointer may end up pointing to already freed memory.
• When trying to access the next node in the tree, the kernel uses invalid memory, causing:
  • Kernel Panic (system crash).
  • Possible malicious code execution (if an attacker exploits the race condition).

---

📊 Status and Metrics

---

🛠️ Solution (Patch)

The kernel development team implemented a critical patch that replaces node handling with RB_CLEAR_NODE(). This ensures that:

• When deleting a node from the tree, any read attempt returns NULL instead of a pointer to freed memory.
• Prevents the UAF by properly invalidating the node.

📌 Patched Kernel Versions

The patch is already available in the following stable branches:

• 6.1.x
• 6.6.x
• 6.12.x
• 6.13.x

---

🔗 Official References (Git Kernel.org)

To review the exact patch code, see these commits:

• Commit 03de7ff
• Commit 6f24827

---

📜 Technical Description (NIST)

"In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de(). PDE is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in UAF access. We should use RB_CLEAR_NODE() to set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid UAF access."

🔄 Steps to Reproduce the Problem

1. Process 1: Uses getdent to traverse /proc/pid/net/dev_snmp6/ (the current pointer is tun3).
2. Process 2: In a critical time window, unregisters network devices (tun3 and tun2), removing them from the tree.
   • First tun3 is removed, then tun2 (freed to the slab).
3. Process 1: Continues traversal with getdent, but pde_subdir_next() returns tun2 (already freed), causing UAF.

---

📊 Weakness Enumeration and Metrics

---

🔗 Useful Links

---

⚠️ Final Recommendation: If you use kernel versions 6.1.x, 6.6.x, 6.12.x or 6.13.x, update immediately to a patched version. If not possible, consider applying the commits manually or restricting access to /proc via security policies (e.g. chroot, SELinux).