What is CVE-2025-40173?

CVE-2025-40173 is a high-severity vulnerability in Linux. CVSS score: 7.8/10. Published 2025-11-12.

How severe is CVE-2025-40173?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Linux

CVE-2025-40173

In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), ipv6 tunnel yet increases the headroom without any ceiling. Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. Credits to Francesco Ruggeri, who was originally debugging this issue and wrote local Arista-specific patch and a reproducer.

EPSS: 0.002 (9.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Linux — versions 8eb30be0352d09165e94a41fef1c7b994dca0714, 4.7, 0

References

Frequently asked questions

What is CVE-2025-40173?: CVE-2025-40173 is a high-severity vulnerability in Linux. CVSS score: 7.8/10. Published 2025-11-12.
How severe is CVE-2025-40173?: High severity. CVSS v3 base score is 7.8 out of 10.