CVE-2025-40173 net/ip6_tunnel: Prevent perpetual tunnel growth
Attackers can cause a denial of service by triggering perpetual headroom growth in IPv6 tunnels, affecting Linux kernel users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40173?
CVE-2025-40173 is a high-severity denial of service vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/ip6_tunnel: Prevent perpetual tunnel growth
Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), ipv6 tunnel yet increases the headroom without any ceiling.
Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
Credits to Francesco Ruggeri, who was originally debugging this issue and wrote local Arista-specific patch and a reproducer.
Which versions are affected by CVE-2025-40173?
How do I fix CVE-2025-40173?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-40173 being exploited?
There is no known exploitation of CVE-2025-40173 in the wild and no public exploit code.
Sources
Also known as AZL-70019, BELL-CVE-2025-40173, DEBIAN-CVE-2025-40173, GHSA-hr9g-hq4q-3hfj, ROOT-OS-DEBIAN-11-CVE-2025-40173, ROOT-OS-DEBIAN-13-CVE-2025-40173 and 2 more.