CVE-2025-40091

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc2-tnguy.net-queue+

Description A use-after-free issue exists in the Linux kernel's ixgbe driver. Specifically, the devlink free() function is called prematurely within the ixgbe remove() path. This occurs because the ixgbe adapter is embedded within devlink, and freeing it too early can lead to a use-after-free condition. The issue was identified through a Kernel Address Sanitizer (KASAN) report during testing. The vulnerable function is ixgbe reset interrupt capability().

Recommendations Update to a version of the Linux kernel newer than 6.17.0-rc2-tnguy.net-queue+.