https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T21:37:27.335614+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-40133 CVE-2025-40133 — mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). 2026-09-28T21:37:27.338496+00:00

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().

mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().