Security tracker / CVE-2025-40251

CVE-2025-40251

devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in d75559845078 ("devlink: Allow setting parent node of rate
 carnil> objects"). Vulnerable versions: 5.14.

Bugs

Status

Branch	Status
upstream	released (6.18-rc7) [f94c1a114ac209977bdf5ca841b98424295ab1f0]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	released (6.17.10) [542f45486f1ce2d2dde75bd85aca0389ef7046c3]
6.12-upstream-stable	released (6.12.60) [c70df6c17d389cc743f0eb30160e2d6bc6910db8]
6.6-upstream-stable	released (6.6.118) [715d9cda646a8a38ea8b2bb5afb679a7464055e2]
6.1-upstream-stable	needed
5.10-upstream-stable	N/A "Vulnerable code not present"
sid	released (6.17.10-1)
6.12-trixie-security	released (6.12.63-1)
6.1-bookworm-security	needed
5.10-bullseye-security	N/A "Vulnerable code not present"