CVE-2025-40173

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw in the IPv6 tunnel implementation where the headroom can increase indefinitely, similar to a previously addressed issue in the IPv4 tunnel. This occurs because the dev->needed headroom is updated in the IPv6 version without any limit, potentially leading to excessive memory consumption. The issue was identified by Francesco Ruggeri, who provided a reproducer and a local patch.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.