CVE-2025-40018 – ipvs: Defer ip_vs_ftp unregister during netns cleanup

CVE ID : CVE-2025-40018

Published : Oct. 24, 2025, 12:15 p.m. | 28 minutes ago

Description : In the Linux kernel, the following vulnerability has been resolved:

ipvs: Defer ip_vs_ftp unregister during netns cleanup

On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
before connections with valid cp->app pointers are flushed, leading to a
use-after-free.

Fix this by introducing a global `exiting_module` flag, set to true in
ip_vs_ftp_exit() before unregistering the pernet subsystem. In
__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
cleanup (when exiting_module is false) and defer it to
__ip_vs_cleanup_batch(), which unregisters all apps after all connections
are flushed. If called during module exit, unregister ip_vs_ftp
immediately.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…