CVE-2025-40251

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18.0-rc4+

Description The devl rate nodes destroy function in the Linux kernel did not correctly unset the parent pointer for rate objects, leading to a dangling pointer in the devlink rate struct. This issue caused refcount errors in netdevsim and mlx5. The function was documented to unset the parent pointer, but only decremented the parent's refcount without setting devlink rate->parent to NULL. This inconsistency with devlink nl rate parent node set resulted in memory leaks. The issue was observed during device removal in netdevsim and mlx5 environments.

Recommendations Update to Linux kernel version 6.18.0-rc4+ or later.