GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40186 (GCVE-0-2025-40186)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:56 – Updated: 2026-08-05 12:08
VLAI
Title
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7ec092a91ff351dcde89c23e795b73a328274db6 , < e359b742eac1eac75cff4e38ee2e8cea492acd9b (git)
Affected: a4378dedd6e07e62f2fccb17d78c9665718763d0 , < ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d (git)
Affected: 33a4fdf0b4a25f8ce65380c3b0136b407ca57609 , < eb85ad5f23268d64b037bfb545cbcba3752f90c7 (git)
Affected: 17d699727577814198d744d6afe54735c6b54c99 , < 643a94b0cf767325e953591c212be2eb826b9d7f (git)
Affected: dfd06131107e7b699ef1e2a24ed2f7d17c917753 , < 422c1c173c39bbbae1e0eaaf8aefe40b2596233b (git)
Affected: fa4749c065644af4db496b338452a69a3e5147d9 , < c11ace909e873118295e9eb22dc8c58b0b50eb32 (git)
Affected: 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 , < 64dc47a13aa3d9daf7cec29b44dca8e22a6aea15 (git)
Affected: 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 , < 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c (git)
Affected: ae313d14b45eca7a6bb29cb9bf396d977e7d28fb (git)
Affected: 5.4.300 , < 5.4.301 (semver)
Affected: 5.10.245 , < 5.10.246 (semver)
Affected: 5.15.194 , < 5.15.195 (semver)
Affected: 6.1.154 , < 6.1.157 (semver)
Affected: 6.6.108 , < 6.6.113 (semver)
Affected: 6.12.49 , < 6.12.54 (semver)
Affected: 6.16.9 , < 6.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 5.4.301 , ≤ 5.4.* (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.157 , ≤ 6.1.* (semver)
Unaffected: 6.6.113 , ≤ 6.6.* (semver)
Unaffected: 6.12.54 , ≤ 6.12.* (semver)
Unaffected: 6.17.4 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e359b742eac1eac75cff4e38ee2e8cea492acd9b",
              "status": "affected",
              "version": "7ec092a91ff351dcde89c23e795b73a328274db6",
              "versionType": "git"
            },
            {
              "lessThan": "ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d",
              "status": "affected",
              "version": "a4378dedd6e07e62f2fccb17d78c9665718763d0",
              "versionType": "git"
            },
            {
              "lessThan": "eb85ad5f23268d64b037bfb545cbcba3752f90c7",
              "status": "affected",
              "version": "33a4fdf0b4a25f8ce65380c3b0136b407ca57609",
              "versionType": "git"
            },
            {
              "lessThan": "643a94b0cf767325e953591c212be2eb826b9d7f",
              "status": "affected",
              "version": "17d699727577814198d744d6afe54735c6b54c99",
              "versionType": "git"
            },
            {
              "lessThan": "422c1c173c39bbbae1e0eaaf8aefe40b2596233b",
              "status": "affected",
              "version": "dfd06131107e7b699ef1e2a24ed2f7d17c917753",
              "versionType": "git"
            },
            {
              "lessThan": "c11ace909e873118295e9eb22dc8c58b0b50eb32",
              "status": "affected",
              "version": "fa4749c065644af4db496b338452a69a3e5147d9",
              "versionType": "git"
            },
            {
              "lessThan": "64dc47a13aa3d9daf7cec29b44dca8e22a6aea15",
              "status": "affected",
              "version": "45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01",
              "versionType": "git"
            },
            {
              "lessThan": "2e7cbbbe3d61c63606994b7ff73c72537afe2e1c",
              "status": "affected",
              "version": "45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ae313d14b45eca7a6bb29cb9bf396d977e7d28fb",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.301",
              "status": "affected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.246",
              "status": "affected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.195",
              "status": "affected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.157",
              "status": "affected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.113",
              "status": "affected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.54",
              "status": "affected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "5.4.300",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "5.10.245",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "5.15.194",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.157",
                  "versionStartIncluding": "6.1.154",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.113",
                  "versionStartIncluding": "6.6.108",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "6.12.49",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Don\u0027t call reqsk_fastopen_remove() in tcp_conn_request().\n\nsyzbot reported the splat below in tcp_conn_request(). [0]\n\nIf a listener is close()d while a TFO socket is being processed in\ntcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk-\u003esk\nand calls inet_child_forget(), which calls tcp_disconnect() for the\nTFO socket.\n\nAfter the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),\nwhere reqsk_put() is called due to !reqsk-\u003esk.\n\nThen, reqsk_fastopen_remove() in tcp_conn_request() decrements the\nlast req-\u003ersk_refcnt and frees reqsk, and __reqsk_free() at the\ndrop_and_free label causes the refcount underflow for the listener\nand double-free of the reqsk.\n\nLet\u0027s remove reqsk_fastopen_remove() in tcp_conn_request().\n\nNote that other callers make sure tp-\u003efastopen_rsk is not NULL.\n\n[0]:\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)\nModules linked in:\nCPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:refcount_warn_saturate (lib/refcount.c:28)\nCode: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff \u003c0f\u003e 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6\nRSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246\nRAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900\nRDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280\nRBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280\nR10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100\nR13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8\nFS:  00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0\nCall Trace:\n \u003cIRQ\u003e\n tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)\n tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)\n tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)\n tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)\n ip6_input (net/ipv6/ip6_input.c:500)\n ipv6_rcv (net/ipv6/ip6_input.c:311)\n __netif_receive_skb (net/core/dev.c:6104)\n process_backlog (net/core/dev.c:6456)\n __napi_poll (net/core/dev.c:7506)\n net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)\n handle_softirqs (kernel/softirq.c:579)\n do_softirq (kernel/softirq.c:480)\n \u003c/IRQ\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in the TCP/IP stack\u0027s inbound SYN-processing path (tcp_v6_rcv \u2192 tcp_rcv_state_process \u2192 tcp_conn_request), triggered by a received TCP Fast Open SYN packet from a remote peer.\nAC:H - Triggering requires the listener socket to transition out of TCP_LISTEN (a local close()/shutdown()) at the exact moment an inbound TFO SYN is being processed; a remote attacker cannot control the timing of that close, so success depends on conditions beyond their control.\nPR:N - The TFO SYN is processed pre-connection with no authentication; an unauthenticated remote attacker needs no privileges to reach tcp_conn_request().\nUI:N - The bug is triggered purely by network packet processing racing with a listener close; no victim interaction is required.\nS:U - The corruption stays within the kernel\u0027s own memory/security authority (request_sock slab and listener refcount); no VM/IOMMU/sandbox boundary is crossed.\nC:H - The refcount underflow yields a use-after-free/double-free of a request_sock, giving an attacker control over freed-object contents that can be leveraged to read adjacent kernel memory.\nI:H - The double-free/UAF is a heap-corruption primitive that can be groomed into an arbitrary-write / control-flow-hijack, so integrity impact is high.\nA:H - The refcount underflow and double-free reliably corrupt kernel memory and crash the kernel (oops/panic in softirq context), a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:24.563Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e359b742eac1eac75cff4e38ee2e8cea492acd9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb85ad5f23268d64b037bfb545cbcba3752f90c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/643a94b0cf767325e953591c212be2eb826b9d7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/422c1c173c39bbbae1e0eaaf8aefe40b2596233b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c11ace909e873118295e9eb22dc8c58b0b50eb32"
        },
        {
          "url": "https://git.kernel.org/stable/c/64dc47a13aa3d9daf7cec29b44dca8e22a6aea15"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e7cbbbe3d61c63606994b7ff73c72537afe2e1c"
        }
      ],
      "title": "tcp: Don\u0027t call reqsk_fastopen_remove() in tcp_conn_request().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40186",
    "datePublished": "2025-11-12T21:56:29.033Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-08-05T12:08:24.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40186",
      "date": "2026-09-16",
      "epss": "0.00541",
      "percentile": "0.4414"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40186\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-12T22:15:45.443\",\"lastModified\":\"2026-07-30T06:24:16.610\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: Don\u0027t call reqsk_fastopen_remove() in tcp_conn_request().\\n\\nsyzbot reported the splat below in tcp_conn_request(). [0]\\n\\nIf a listener is close()d while a TFO socket is being processed in\\ntcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk-\u003esk\\nand calls inet_child_forget(), which calls tcp_disconnect() for the\\nTFO socket.\\n\\nAfter the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),\\nwhere reqsk_put() is called due to !reqsk-\u003esk.\\n\\nThen, reqsk_fastopen_remove() in tcp_conn_request() decrements the\\nlast req-\u003ersk_refcnt and frees reqsk, and __reqsk_free() at the\\ndrop_and_free label causes the refcount underflow for the listener\\nand double-free of the reqsk.\\n\\nLet\u0027s remove reqsk_fastopen_remove() in tcp_conn_request().\\n\\nNote that other callers make sure tp-\u003efastopen_rsk is not NULL.\\n\\n[0]:\\nrefcount_t: underflow; use-after-free.\\nWARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)\\nModules linked in:\\nCPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\\nRIP: 0010:refcount_warn_saturate (lib/refcount.c:28)\\nCode: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff \u003c0f\u003e 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6\\nRSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246\\nRAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900\\nRDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280\\nRBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280\\nR10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100\\nR13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8\\nFS:  00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0\\nCall Trace:\\n \u003cIRQ\u003e\\n tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)\\n tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)\\n tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)\\n tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)\\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)\\n ip6_input (net/ipv6/ip6_input.c:500)\\n ipv6_rcv (net/ipv6/ip6_input.c:311)\\n __netif_receive_skb (net/core/dev.c:6104)\\n process_backlog (net/core/dev.c:6456)\\n __napi_poll (net/core/dev.c:7506)\\n net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)\\n handle_softirqs (kernel/softirq.c:579)\\n do_softirq (kernel/softirq.c:480)\\n \u003c/IRQ\u003e\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/tcp_input.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7ec092a91ff351dcde89c23e795b73a328274db6\",\"lessThan\":\"e359b742eac1eac75cff4e38ee2e8cea492acd9b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a4378dedd6e07e62f2fccb17d78c9665718763d0\",\"lessThan\":\"ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33a4fdf0b4a25f8ce65380c3b0136b407ca57609\",\"lessThan\":\"eb85ad5f23268d64b037bfb545cbcba3752f90c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"17d699727577814198d744d6afe54735c6b54c99\",\"lessThan\":\"643a94b0cf767325e953591c212be2eb826b9d7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dfd06131107e7b699ef1e2a24ed2f7d17c917753\",\"lessThan\":\"422c1c173c39bbbae1e0eaaf8aefe40b2596233b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fa4749c065644af4db496b338452a69a3e5147d9\",\"lessThan\":\"c11ace909e873118295e9eb22dc8c58b0b50eb32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01\",\"lessThan\":\"64dc47a13aa3d9daf7cec29b44dca8e22a6aea15\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01\",\"lessThan\":\"2e7cbbbe3d61c63606994b7ff73c72537afe2e1c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae313d14b45eca7a6bb29cb9bf396d977e7d28fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.300\",\"lessThan\":\"5.4.301\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.245\",\"lessThan\":\"5.10.246\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.194\",\"lessThan\":\"5.15.195\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.154\",\"lessThan\":\"6.1.157\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.108\",\"lessThan\":\"6.6.113\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.49\",\"lessThan\":\"6.12.54\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.16.9\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/tcp_input.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.301\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.246\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.195\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.157\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.113\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.54\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.4\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2e7cbbbe3d61c63606994b7ff73c72537afe2e1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/422c1c173c39bbbae1e0eaaf8aefe40b2596233b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/643a94b0cf767325e953591c212be2eb826b9d7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/64dc47a13aa3d9daf7cec29b44dca8e22a6aea15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c11ace909e873118295e9eb22dc8c58b0b50eb32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e359b742eac1eac75cff4e38ee2e8cea492acd9b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb85ad5f23268d64b037bfb545cbcba3752f90c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-30T08:20:48+00:00",
      "cve": "CVE-2025-40186",
      "id": "CVE-2025-40186",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:fixed": "1392",
      "product_status:known_affected": "212",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Privilege escalation or Denial of Service via TCP Fast Open vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40186.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T00:17:54Z",
      "cve": "CVE-2025-40186",
      "id": "CVE-2025-40186",
      "initial_release_date": "2025-11-14T00:24:02Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "322",
      "product_status:recommended": "597",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40186",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40186.json",
      "version": "51"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.