CVE-2025-40258 (GCVE-0-2025-40258)

Vulnerability from cvelistv5 – Published: 2025-12-04 16:08 – Updated: 2026-08-05 12:08
VLAI
Title
mptcp: fix race condition in mptcp_schedule_work()
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3b1d6210a9577369103330b0d802b0bf74b65e7f , < f865e6595acf33083168db76921e66ace8bf0e5b (git)
Affected: 3b1d6210a9577369103330b0d802b0bf74b65e7f , < 99908e2d601236842d705d5fd04fb349577316f5 (git)
Affected: 3b1d6210a9577369103330b0d802b0bf74b65e7f , < db4f7968a75250ca6c4ed70d0a78beabb2dcee18 (git)
Affected: 3b1d6210a9577369103330b0d802b0bf74b65e7f , < 8f9ba1a99a89feef9b5867c15a0141a97e893309 (git)
Affected: 3b1d6210a9577369103330b0d802b0bf74b65e7f , < ac28dfddedf6f209190950fc71bcff65ec4ab47b (git)
Affected: 3b1d6210a9577369103330b0d802b0bf74b65e7f , < 3fc7723ed01d1130d4bf7063c50e0af60ecccbb4 (git)
Affected: 3b1d6210a9577369103330b0d802b0bf74b65e7f , < 035bca3f017ee9dea3a5a756e77a6f7138cc6eea (git)
Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.247 , ≤ 5.10.* (semver)
Unaffected: 5.15.197 , ≤ 5.15.* (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.118 , ≤ 6.6.* (semver)
Unaffected: 6.12.60 , ≤ 6.12.* (semver)
Unaffected: 6.17.10 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens RUGGEDCOM RST2428P Affected: 0 , < V4.0 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:11.516Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40258",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:42:15.474459Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:42:29.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f865e6595acf33083168db76921e66ace8bf0e5b",
              "status": "affected",
              "version": "3b1d6210a9577369103330b0d802b0bf74b65e7f",
              "versionType": "git"
            },
            {
              "lessThan": "99908e2d601236842d705d5fd04fb349577316f5",
              "status": "affected",
              "version": "3b1d6210a9577369103330b0d802b0bf74b65e7f",
              "versionType": "git"
            },
            {
              "lessThan": "db4f7968a75250ca6c4ed70d0a78beabb2dcee18",
              "status": "affected",
              "version": "3b1d6210a9577369103330b0d802b0bf74b65e7f",
              "versionType": "git"
            },
            {
              "lessThan": "8f9ba1a99a89feef9b5867c15a0141a97e893309",
              "status": "affected",
              "version": "3b1d6210a9577369103330b0d802b0bf74b65e7f",
              "versionType": "git"
            },
            {
              "lessThan": "ac28dfddedf6f209190950fc71bcff65ec4ab47b",
              "status": "affected",
              "version": "3b1d6210a9577369103330b0d802b0bf74b65e7f",
              "versionType": "git"
            },
            {
              "lessThan": "3fc7723ed01d1130d4bf7063c50e0af60ecccbb4",
              "status": "affected",
              "version": "3b1d6210a9577369103330b0d802b0bf74b65e7f",
              "versionType": "git"
            },
            {
              "lessThan": "035bca3f017ee9dea3a5a756e77a6f7138cc6eea",
              "status": "affected",
              "version": "3b1d6210a9577369103330b0d802b0bf74b65e7f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix race condition in mptcp_schedule_work()\n\nsyzbot reported use-after-free in mptcp_schedule_work() [1]\n\nIssue here is that mptcp_schedule_work() schedules a work,\nthen gets a refcount on sk-\u003esk_refcnt if the work was scheduled.\nThis refcount will be released by mptcp_worker().\n\n[A] if (schedule_work(...)) {\n[B]     sock_hold(sk);\n        return true;\n    }\n\nProblem is that mptcp_worker() can run immediately and complete before [B]\n\nWe need instead :\n\n    sock_hold(sk);\n    if (schedule_work(...))\n        return true;\n    sock_put(sk);\n\n[1]\nrefcount_t: addition on 0; use-after-free.\n WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25\nCall Trace:\n \u003cTASK\u003e\n __refcount_add include/linux/refcount.h:-1 [inline]\n  __refcount_inc include/linux/refcount.h:366 [inline]\n  refcount_inc include/linux/refcount.h:383 [inline]\n  sock_hold include/net/sock.h:816 [inline]\n  mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943\n  mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316\n  call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747\n  expire_timers kernel/time/timer.c:1798 [inline]\n  __run_timers kernel/time/timer.c:2372 [inline]\n  __run_timer_base+0x648/0x970 kernel/time/timer.c:2384\n  run_timer_base kernel/time/timer.c:2393 [inline]\n  run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403\n  handle_softirqs+0x22f/0x710 kernel/softirq.c:622\n  __do_softirq kernel/softirq.c:656 [inline]\n  run_ktimerd+0xcf/0x190 kernel/softirq.c:1138\n  smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable function is reached directly from the packet receive path (`tcp_input.c` \u2192 `mptcp_incoming_options()` on received MP_FASTCLOSE and DATA_FIN options) and from the mp_fail/close timeouts armed by remote peer behaviour such as a bad DSS checksum or subflow reset. A remote MPTCP peer drives the connection state machine that schedules the work, making this reachable over the network with no local access.\nAC:L - The attacker controls both sides of the race by opening and tearing down large numbers of MPTCP connections/subflows, generating an unbounded stream of work-scheduling events (timer expiry, MP_FASTCLOSE, DATA_FIN, subflow close) that each retry the race. The window is further widened on threaded-softirq/PREEMPT_RT kernels (as in the syzbot trace, `run_ktimerd`) and under vCPU preemption in virtualized deployments, so success is achievable at will through repetition.\nPR:N - No credentials or capabilities are checked anywhere on the path; a remote peer of an MPTCP connection (or an unauthenticated client connecting to an MPTCP-enabled listener) triggers the option-parsing and timeout paths in softirq context. Locally the same code is reachable by any unprivileged user simply creating and closing `IPPROTO_MPTCP` sockets.\nUI:N - The race is triggered entirely by attacker-generated traffic and normal MPTCP connection teardown/timeout processing. No victim action of any kind is required.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary. This is a standard in-kernel use-after-free.\nC:H - The `struct sock` is freed while still referenced, and the freed slab object can be reallocated and read back through the still-live MPTCP socket/timer state, exposing arbitrary kernel heap contents. Use-after-free on a socket object gives an attacker control over the contents of the freed object, enabling kernel memory disclosure.\nI:H - After the premature free, `sock_hold()` performs a refcount increment write at a fixed offset into freed (and potentially reallocated) memory, and the trailing `sock_put()` can re-enter `sk_free()`/`sk_destruct` on that object, producing a double free and freelist corruption. These are established primitives for heap grooming and control-flow hijacking, i.e. full integrity loss.\nA:H - The reported symptom is a refcount underflow warning followed by use-after-free of the MPTCP socket, which readily results in an oops or panic when the freed object is dereferenced by the timer, workqueue, or destructor path. Any UAF of this kind reliably crashes the kernel, and it can be triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:58.094Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f865e6595acf33083168db76921e66ace8bf0e5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/99908e2d601236842d705d5fd04fb349577316f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/db4f7968a75250ca6c4ed70d0a78beabb2dcee18"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f9ba1a99a89feef9b5867c15a0141a97e893309"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac28dfddedf6f209190950fc71bcff65ec4ab47b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fc7723ed01d1130d4bf7063c50e0af60ecccbb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/035bca3f017ee9dea3a5a756e77a6f7138cc6eea"
        }
      ],
      "title": "mptcp: fix race condition in mptcp_schedule_work()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40258",
    "datePublished": "2025-12-04T16:08:19.176Z",
    "dateReserved": "2025-04-16T07:20:57.182Z",
    "dateUpdated": "2026-08-05T12:08:58.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40258",
      "date": "2026-08-05",
      "epss": "0.00454",
      "percentile": "0.37159"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40258\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-04T16:16:19.640\",\"lastModified\":\"2026-07-30T06:24:23.160\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: fix race condition in mptcp_schedule_work()\\n\\nsyzbot reported use-after-free in mptcp_schedule_work() [1]\\n\\nIssue here is that mptcp_schedule_work() schedules a work,\\nthen gets a refcount on sk-\u003esk_refcnt if the work was scheduled.\\nThis refcount will be released by mptcp_worker().\\n\\n[A] if (schedule_work(...)) {\\n[B]     sock_hold(sk);\\n        return true;\\n    }\\n\\nProblem is that mptcp_worker() can run immediately and complete before [B]\\n\\nWe need instead :\\n\\n    sock_hold(sk);\\n    if (schedule_work(...))\\n        return true;\\n    sock_put(sk);\\n\\n[1]\\nrefcount_t: addition on 0; use-after-free.\\n WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25\\nCall Trace:\\n \u003cTASK\u003e\\n __refcount_add include/linux/refcount.h:-1 [inline]\\n  __refcount_inc include/linux/refcount.h:366 [inline]\\n  refcount_inc include/linux/refcount.h:383 [inline]\\n  sock_hold include/net/sock.h:816 [inline]\\n  mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943\\n  mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316\\n  call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747\\n  expire_timers kernel/time/timer.c:1798 [inline]\\n  __run_timers kernel/time/timer.c:2372 [inline]\\n  __run_timer_base+0x648/0x970 kernel/time/timer.c:2384\\n  run_timer_base kernel/time/timer.c:2393 [inline]\\n  run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403\\n  handle_softirqs+0x22f/0x710 kernel/softirq.c:622\\n  __do_softirq kernel/softirq.c:656 [inline]\\n  run_ktimerd+0xcf/0x190 kernel/softirq.c:1138\\n  smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160\\n  kthread+0x711/0x8a0 kernel/kthread.c:463\\n  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mptcp/protocol.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3b1d6210a9577369103330b0d802b0bf74b65e7f\",\"lessThan\":\"f865e6595acf33083168db76921e66ace8bf0e5b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b1d6210a9577369103330b0d802b0bf74b65e7f\",\"lessThan\":\"99908e2d601236842d705d5fd04fb349577316f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b1d6210a9577369103330b0d802b0bf74b65e7f\",\"lessThan\":\"db4f7968a75250ca6c4ed70d0a78beabb2dcee18\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b1d6210a9577369103330b0d802b0bf74b65e7f\",\"lessThan\":\"8f9ba1a99a89feef9b5867c15a0141a97e893309\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b1d6210a9577369103330b0d802b0bf74b65e7f\",\"lessThan\":\"ac28dfddedf6f209190950fc71bcff65ec4ab47b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b1d6210a9577369103330b0d802b0bf74b65e7f\",\"lessThan\":\"3fc7723ed01d1130d4bf7063c50e0af60ecccbb4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b1d6210a9577369103330b0d802b0bf74b65e7f\",\"lessThan\":\"035bca3f017ee9dea3a5a756e77a6f7138cc6eea\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mptcp/protocol.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.247\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.197\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.159\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.118\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.60\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.10\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-16T19:42:15.474459Z\",\"id\":\"CVE-2025-40258\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/035bca3f017ee9dea3a5a756e77a6f7138cc6eea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3fc7723ed01d1130d4bf7063c50e0af60ecccbb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8f9ba1a99a89feef9b5867c15a0141a97e893309\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/99908e2d601236842d705d5fd04fb349577316f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ac28dfddedf6f209190950fc71bcff65ec4ab47b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db4f7968a75250ca6c4ed70d0a78beabb2dcee18\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f865e6595acf33083168db76921e66ace8bf0e5b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:38:20+00:00",
      "cve": "CVE-2025-40258",
      "id": "CVE-2025-40258",
      "initial_release_date": "2025-12-04T00:00:00+00:00",
      "product_status:fixed": "2230",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: fix race condition in mptcp_schedule_work()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40258.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-31T01:02:23Z",
      "cve": "CVE-2025-40258",
      "id": "CVE-2025-40258",
      "initial_release_date": "2025-12-05T00:25:20Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "409",
      "product_status:known_not_affected": "154",
      "product_status:recommended": "806",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40258",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40258.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM RST2428P\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-06-02T13:00:11.516Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-40258\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T19:42:15.474459Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T19:42:23.571Z\"}}], \"cna\": {\"title\": \"mptcp: fix race condition in mptcp_schedule_work()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3b1d6210a9577369103330b0d802b0bf74b65e7f\", \"lessThan\": \"f865e6595acf33083168db76921e66ace8bf0e5b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3b1d6210a9577369103330b0d802b0bf74b65e7f\", \"lessThan\": \"99908e2d601236842d705d5fd04fb349577316f5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3b1d6210a9577369103330b0d802b0bf74b65e7f\", \"lessThan\": \"db4f7968a75250ca6c4ed70d0a78beabb2dcee18\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3b1d6210a9577369103330b0d802b0bf74b65e7f\", \"lessThan\": \"8f9ba1a99a89feef9b5867c15a0141a97e893309\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3b1d6210a9577369103330b0d802b0bf74b65e7f\", \"lessThan\": \"ac28dfddedf6f209190950fc71bcff65ec4ab47b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3b1d6210a9577369103330b0d802b0bf74b65e7f\", \"lessThan\": \"3fc7723ed01d1130d4bf7063c50e0af60ecccbb4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3b1d6210a9577369103330b0d802b0bf74b65e7f\", \"lessThan\": \"035bca3f017ee9dea3a5a756e77a6f7138cc6eea\", \"versionType\": \"git\"}], \"programFiles\": [\"net/mptcp/protocol.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.247\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.197\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.118\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.60\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.17.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/mptcp/protocol.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f865e6595acf33083168db76921e66ace8bf0e5b\"}, {\"url\": \"https://git.kernel.org/stable/c/99908e2d601236842d705d5fd04fb349577316f5\"}, {\"url\": \"https://git.kernel.org/stable/c/db4f7968a75250ca6c4ed70d0a78beabb2dcee18\"}, {\"url\": \"https://git.kernel.org/stable/c/8f9ba1a99a89feef9b5867c15a0141a97e893309\"}, {\"url\": \"https://git.kernel.org/stable/c/ac28dfddedf6f209190950fc71bcff65ec4ab47b\"}, {\"url\": \"https://git.kernel.org/stable/c/3fc7723ed01d1130d4bf7063c50e0af60ecccbb4\"}, {\"url\": \"https://git.kernel.org/stable/c/035bca3f017ee9dea3a5a756e77a6f7138cc6eea\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: fix race condition in mptcp_schedule_work()\\n\\nsyzbot reported use-after-free in mptcp_schedule_work() [1]\\n\\nIssue here is that mptcp_schedule_work() schedules a work,\\nthen gets a refcount on sk-\u003esk_refcnt if the work was scheduled.\\nThis refcount will be released by mptcp_worker().\\n\\n[A] if (schedule_work(...)) {\\n[B]     sock_hold(sk);\\n        return true;\\n    }\\n\\nProblem is that mptcp_worker() can run immediately and complete before [B]\\n\\nWe need instead :\\n\\n    sock_hold(sk);\\n    if (schedule_work(...))\\n        return true;\\n    sock_put(sk);\\n\\n[1]\\nrefcount_t: addition on 0; use-after-free.\\n WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25\\nCall Trace:\\n \u003cTASK\u003e\\n __refcount_add include/linux/refcount.h:-1 [inline]\\n  __refcount_inc include/linux/refcount.h:366 [inline]\\n  refcount_inc include/linux/refcount.h:383 [inline]\\n  sock_hold include/net/sock.h:816 [inline]\\n  mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943\\n  mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316\\n  call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747\\n  expire_timers kernel/time/timer.c:1798 [inline]\\n  __run_timers kernel/time/timer.c:2372 [inline]\\n  __run_timer_base+0x648/0x970 kernel/time/timer.c:2384\\n  run_timer_base kernel/time/timer.c:2393 [inline]\\n  run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403\\n  handle_softirqs+0x22f/0x710 kernel/softirq.c:622\\n  __do_softirq kernel/softirq.c:656 [inline]\\n  run_ktimerd+0xcf/0x190 kernel/softirq.c:1138\\n  smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160\\n  kthread+0x711/0x8a0 kernel/kthread.c:463\\n  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.247\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.197\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.159\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.118\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.60\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17.10\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18\", \"versionStartIncluding\": \"5.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:45:51.351Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-40258\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-16T19:42:29.618Z\", \"dateReserved\": \"2025-04-16T07:20:57.182Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-12-04T16:08:19.176Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.