{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40258","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.182Z","datePublished":"2025-12-04T16:08:19.176Z","dateUpdated":"2026-08-05T12:08:58.094Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:08:58.094Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix race condition in mptcp_schedule_work()\n\nsyzbot reported use-after-free in mptcp_schedule_work() [1]\n\nIssue here is that mptcp_schedule_work() schedules a work,\nthen gets a refcount on sk->sk_refcnt if the work was scheduled.\nThis refcount will be released by mptcp_worker().\n\n[A] if (schedule_work(...)) {\n[B]     sock_hold(sk);\n        return true;\n    }\n\nProblem is that mptcp_worker() can run immediately and complete before [B]\n\nWe need instead :\n\n    sock_hold(sk);\n    if (schedule_work(...))\n        return true;\n    sock_put(sk);\n\n[1]\nrefcount_t: addition on 0; use-after-free.\n WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25\nCall Trace:\n <TASK>\n __refcount_add include/linux/refcount.h:-1 [inline]\n  __refcount_inc include/linux/refcount.h:366 [inline]\n  refcount_inc include/linux/refcount.h:383 [inline]\n  sock_hold include/net/sock.h:816 [inline]\n  mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943\n  mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316\n  call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747\n  expire_timers kernel/time/timer.c:1798 [inline]\n  __run_timers kernel/time/timer.c:2372 [inline]\n  __run_timer_base+0x648/0x970 kernel/time/timer.c:2384\n  run_timer_base kernel/time/timer.c:2393 [inline]\n  run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403\n  handle_softirqs+0x22f/0x710 kernel/softirq.c:622\n  __do_softirq kernel/softirq.c:656 [inline]\n  run_ktimerd+0xcf/0x190 kernel/softirq.c:1138\n  smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable function is reached directly from the packet receive path (`tcp_input.c` → `mptcp_incoming_options()` on received MP_FASTCLOSE and DATA_FIN options) and from the mp_fail/close timeouts armed by remote peer behaviour such as a bad DSS checksum or subflow reset. A remote MPTCP peer drives the connection state machine that schedules the work, making this reachable over the network with no local access.\nAC:L - The attacker controls both sides of the race by opening and tearing down large numbers of MPTCP connections/subflows, generating an unbounded stream of work-scheduling events (timer expiry, MP_FASTCLOSE, DATA_FIN, subflow close) that each retry the race. The window is further widened on threaded-softirq/PREEMPT_RT kernels (as in the syzbot trace, `run_ktimerd`) and under vCPU preemption in virtualized deployments, so success is achievable at will through repetition.\nPR:N - No credentials or capabilities are checked anywhere on the path; a remote peer of an MPTCP connection (or an unauthenticated client connecting to an MPTCP-enabled listener) triggers the option-parsing and timeout paths in softirq context. Locally the same code is reachable by any unprivileged user simply creating and closing `IPPROTO_MPTCP` sockets.\nUI:N - The race is triggered entirely by attacker-generated traffic and normal MPTCP connection teardown/timeout processing. No victim action of any kind is required.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary. This is a standard in-kernel use-after-free.\nC:H - The `struct sock` is freed while still referenced, and the freed slab object can be reallocated and read back through the still-live MPTCP socket/timer state, exposing arbitrary kernel heap contents. Use-after-free on a socket object gives an attacker control over the contents of the freed object, enabling kernel memory disclosure.\nI:H - After the premature free, `sock_hold()` performs a refcount increment write at a fixed offset into freed (and potentially reallocated) memory, and the trailing `sock_put()` can re-enter `sk_free()`/`sk_destruct` on that object, producing a double free and freelist corruption. These are established primitives for heap grooming and control-flow hijacking, i.e. full integrity loss.\nA:H - The reported symptom is a refcount underflow warning followed by use-after-free of the MPTCP socket, which readily results in an oops or panic when the freed object is dereferenced by the timer, workqueue, or destructor path. Any UAF of this kind reliably crashes the kernel, and it can be triggered repeatedly."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mptcp/protocol.c"],"versions":[{"version":"3b1d6210a9577369103330b0d802b0bf74b65e7f","lessThan":"f865e6595acf33083168db76921e66ace8bf0e5b","status":"affected","versionType":"git"},{"version":"3b1d6210a9577369103330b0d802b0bf74b65e7f","lessThan":"99908e2d601236842d705d5fd04fb349577316f5","status":"affected","versionType":"git"},{"version":"3b1d6210a9577369103330b0d802b0bf74b65e7f","lessThan":"db4f7968a75250ca6c4ed70d0a78beabb2dcee18","status":"affected","versionType":"git"},{"version":"3b1d6210a9577369103330b0d802b0bf74b65e7f","lessThan":"8f9ba1a99a89feef9b5867c15a0141a97e893309","status":"affected","versionType":"git"},{"version":"3b1d6210a9577369103330b0d802b0bf74b65e7f","lessThan":"ac28dfddedf6f209190950fc71bcff65ec4ab47b","status":"affected","versionType":"git"},{"version":"3b1d6210a9577369103330b0d802b0bf74b65e7f","lessThan":"3fc7723ed01d1130d4bf7063c50e0af60ecccbb4","status":"affected","versionType":"git"},{"version":"3b1d6210a9577369103330b0d802b0bf74b65e7f","lessThan":"035bca3f017ee9dea3a5a756e77a6f7138cc6eea","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mptcp/protocol.c"],"versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","status":"unaffected","versionType":"semver"},{"version":"5.10.247","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.197","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.159","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.118","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.60","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.10","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.10.247"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.15.197"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.1.159"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.6.118"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.12.60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.17.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f865e6595acf33083168db76921e66ace8bf0e5b"},{"url":"https://git.kernel.org/stable/c/99908e2d601236842d705d5fd04fb349577316f5"},{"url":"https://git.kernel.org/stable/c/db4f7968a75250ca6c4ed70d0a78beabb2dcee18"},{"url":"https://git.kernel.org/stable/c/8f9ba1a99a89feef9b5867c15a0141a97e893309"},{"url":"https://git.kernel.org/stable/c/ac28dfddedf6f209190950fc71bcff65ec4ab47b"},{"url":"https://git.kernel.org/stable/c/3fc7723ed01d1130d4bf7063c50e0af60ecccbb4"},{"url":"https://git.kernel.org/stable/c/035bca3f017ee9dea3a5a756e77a6f7138cc6eea"}],"title":"mptcp: fix race condition in mptcp_schedule_work()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-06-02T13:00:11.516Z"},"affected":[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","versions":[{"status":"affected","version":"0","lessThan":"V4.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]},{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-16T19:42:15.474459Z","id":"CVE-2025-40258","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-16T19:42:29.618Z"}}]}}