CVE-2025-40363

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: ipv6: fix field-spanning memcpy warning in AH output<br /> <br /> Fix field-spanning memcpy warnings in ah6_output() and<br /> ah6_output_done() where extension headers are copied to/from IPv6<br /> address fields, triggering fortify-string warnings about writes beyond<br /> the 16-byte address fields.<br /> <br /> memcpy: detected field-spanning write (size 40) of single field "&amp;top_iph-&gt;saddr" at net/ipv6/ah6.c:439 (size 16)<br /> WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439<br /> <br /> The warnings are false positives as the extension headers are<br /> intentionally placed after the IPv6 header in memory. Fix by properly<br /> copying addresses and extension headers separately, and introduce<br /> helper functions to avoid code duplication.