Review reviewHigh

CVE-2025-40206

Linux

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6...

CVSS: 7.8
EPSS: 0.14%
CISA KEV: Not listed
Published: 2025.11.13

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.14%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= ee394f96ad7517fbc0de9106dcc7ce9efb14f264 < 0028e0134c64d9ed21728341a74fcfc59cd0f944, >= ee394f96ad7517fbc0de9106dcc7ce9efb14f264 < 7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0, >= ee394f96ad7517fbc0de9106dcc7ce9efb14f264 < 4c1cf72ec10be5a9ad264650cadffa1fbce6fabd, >= ee394f96ad7517fbc0de9106dcc7ce9efb14f264 < f359b809d54c6e3dd1d039b97e0b68390b0e53e4, >= 5.4
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available