CVE-2025-40363

What it actually does

Resolves false positive fortify-string warnings from field-spanning memcpy operations in ah6_output() and ah6_output_done() that copy IPv6 extension headers beyond the 16-byte saddr/daddr fields in net/ipv6/ah6.c.

Why it matters to the business

Unnecessary compiler warnings during kernel builds on systems using IPv6 Authentication Header processing, potentially affecting Red Hat Enterprise Linux 8 high availability and resilient storage deployments using pcs packages; no operational disruption or data risk.

How an attack unfolds

No attacker exploitation is possible; the memcpy warnings are false positives because extension headers are intentionally placed after the IPv6 header in memory. The change separates address and header copies via new helper functions.

How to fix it

Update pcs and pcs-snmp packages on Red Hat Enterprise Linux 8 highavailability or resilientstorage to 0:0.10.4-6.el8_2.1; for kernel sources apply commit 2da805a61ef5272a2773775ce14c3650adb84248.

How to confirm the fix worked

Verify installed package versions match the fixed releases; rebuild kernels from updated sources and confirm absence of the field-spanning memcpy warning at net/ipv6/ah6.c:439.

Typical attack path

1. No attack path exists; this addresses a compiler warning in IPv6 AH output handling rather than an exploitable flaw.

How to detect it

Review kernel build logs for the specific memcpy warning string referencing ah6_output and net/ipv6/ah6.c; no post-exploitation artifacts exist.

What your security team should do

• Apply the listed package updates to pcs and pcs-snmp on affected Red Hat Enterprise Linux 8 systems
• Rebuild and deploy updated kernels incorporating the helper-function changes if maintaining custom kernel sources