[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V4.0","versionType":"custom","status":"affected"}]}]

{"timestamp":"2026-06-10T20:41:14.789338Z","id":"CVE-2025-40251","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/devlink/rate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d7555984507822458b32a6405881038241d140be","lessThan":"90e51e20bcec9bff5b2421ce1bd95704764655f5","versionType":"git","status":"affected"},{"version":"d7555984507822458b32a6405881038241d140be","lessThan":"715d9cda646a8a38ea8b2bb5afb679a7464055e2","versionType":"git","status":"affected"},{"version":"d7555984507822458b32a6405881038241d140be","lessThan":"c70df6c17d389cc743f0eb30160e2d6bc6910db8","versionType":"git","status":"affected"},{"version":"d7555984507822458b32a6405881038241d140be","lessThan":"542f45486f1ce2d2dde75bd85aca0389ef7046c3","versionType":"git","status":"affected"},{"version":"d7555984507822458b32a6405881038241d140be","lessThan":"f94c1a114ac209977bdf5ca841b98424295ab1f0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/devlink/rate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"6.1.164","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.118","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.60","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.17.10","lessThanOrEqual":"6.17.*","versionType":"semver","status":"unaffected"},{"version":"6.18","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

https://cert-portal.siemens.com/productcert/html/ssa-253495.html

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476

OR
          *cpe:2.3:o:linux:linux_kernel:6.18:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.17.10
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.60
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.118
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.14 up to (excluding) 6.1.164

kernel.org: https://git.kernel.org/stable/c/542f45486f1ce2d2dde75bd85aca0389ef7046c3 Types: Patch

kernel.org: https://git.kernel.org/stable/c/715d9cda646a8a38ea8b2bb5afb679a7464055e2 Types: Patch

kernel.org: https://git.kernel.org/stable/c/90e51e20bcec9bff5b2421ce1bd95704764655f5 Types: Patch

kernel.org: https://git.kernel.org/stable/c/c70df6c17d389cc743f0eb30160e2d6bc6910db8 Types: Patch

kernel.org: https://git.kernel.org/stable/c/f94c1a114ac209977bdf5ca841b98424295ab1f0 Types: Patch

https://git.kernel.org/stable/c/90e51e20bcec9bff5b2421ce1bd95704764655f5

In the Linux kernel, the following vulnerability has been resolved:

devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

The function devl_rate_nodes_destroy is documented to "Unset parent for
all rate objects". However, it was only calling the driver-specific
`rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing
the parent's refcount, without actually setting the
`devlink_rate->parent` pointer to NULL.

This leaves a dangling pointer in the `devlink_rate` struct, which cause
refcount error in netdevsim[1] and mlx5[2]. In addition, this is
inconsistent with the behavior of `devlink_nl_rate_parent_node_set`,
where the parent pointer is correctly cleared.

This patch fixes the issue by explicitly setting `devlink_rate->parent`
to NULL after notifying the driver, thus fulfilling the function's
documented behavior for all rate objects.

[1]
repro steps:
echo 1 > /sys/bus/netdevsim/new_device
devlink dev eswitch set netdevsim/netdevsim1 mode switchdev
echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs
devlink port function rate add netdevsim/netdevsim1/test_node
devlink port function rate set netdevsim/netdevsim1/128 parent test_node
echo 1 > /sys/bus/netdevsim/del_device

dmesg:
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0
CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:refcount_warn_saturate+0x42/0xe0
Call Trace:
 <TASK>
 devl_rate_leaf_destroy+0x8d/0x90
 __nsim_dev_port_del+0x6c/0x70 [netdevsim]
 nsim_dev_reload_destroy+0x11c/0x140 [netdevsim]
 nsim_drv_remove+0x2b/0xb0 [netdevsim]
 device_release_driver_internal+0x194/0x1f0
 bus_remove_device+0xc6/0x130
 device_del+0x159/0x3c0
 device_unregister+0x1a/0x60
 del_device_store+0x111/0x170 [netdevsim]
 kernfs_fop_write_iter+0x12e/0x1e0
 vfs_write+0x215/0x3d0
 ksys_write+0x5f/0xd0
 do_syscall_64+0x55/0x10f0
 entry_S

https://git.kernel.org/stable/c/542f45486f1ce2d2dde75bd85aca0389ef7046c3

https://git.kernel.org/stable/c/715d9cda646a8a38ea8b2bb5afb679a7464055e2

https://git.kernel.org/stable/c/c70df6c17d389cc743f0eb30160e2d6bc6910db8

https://git.kernel.org/stable/c/f94c1a114ac209977bdf5ca841b98424295ab1f0