Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-40258— mptcp: fix race condition in mptcp_schedule_work()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于工作调度竞争条件，可能导致引用计数错误。

CVSS 9.8 · Critical EPSS 0.45% · P38

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 3b1d6210a9577369103330b0d802b0bf74b65e7f< f865e6595acf33083168db76921e66ace8bf0e5b affected
3b1d6210a9577369103330b0d802b0bf74b65e7f< 99908e2d601236842d705d5fd04fb349577316f5 affected
3b1d6210a9577369103330b0d802b0bf74b65e7f< db4f7968a75250ca6c4ed70d0a78beabb2dcee18 affected
3b1d6210a9577369103330b0d802b0bf74b65e7f< 8f9ba1a99a89feef9b5867c15a0141a97e893309 affected
3b1d6210a9577369103330b0d802b0bf74b65e7f< ac28dfddedf6f209190950fc71bcff65ec4ab47b affected
3b1d6210a9577369103330b0d802b0bf74b65e7f< 3fc7723ed01d1130d4bf7063c50e0af60ecccbb4 affected
3b1d6210a9577369103330b0d802b0bf74b65e7f< 035bca3f017ee9dea3a5a756e77a6f7138cc6eea affected
5.7 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-40258

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mptcp: fix race condition in mptcp_schedule_work()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于工作调度竞争条件，可能导致引用计数错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3b1d6210a9577369103330b0d802b0bf74b65e7f ~ f865e6595acf33083168db76921e66ace8bf0e5b -
Linux Linux 5.7 -

II. Public POCs for CVE-2025-40258

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-40258

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-12-04 · 53 CVEs total

CVE-2025-40261 9.8 CRITICAL nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
CVE-2025-40252 9.8 CRITICAL net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
CVE-2025-40257 9.8 CRITICAL mptcp: fix a race in mptcp_pm_del_add_timer()
CVE-2025-40253 8.8 HIGH s390/ctcm: Fix double-kfree
CVE-2025-40266 8.2 HIGH KVM: arm64: Check the untrusted offset in FF-A memory share
CVE-2025-40245 7.8 HIGH nios2: ensure that memblock.current_limit is set when setting pfn limits
CVE-2025-40262 7.8 HIGH Input: imx_sc_key - fix memory corruption on unload
CVE-2025-40250 7.8 HIGH net/mlx5: Clean up only new IRQ glue on request_irq() failure
CVE-2025-40251 7.8 HIGH devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
CVE-2025-40248 7.8 HIGH vsock: Ignore signal/timeout on connect() if already established
CVE-2025-40249 7.8 HIGH gpio: cdev: make sure the cdev fd is still active before emitting events
CVE-2025-40214 7.8 HIGH af_unix: Initialise scc_index in unix_add_edge().
CVE-2025-40244 7.8 HIGH hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
CVE-2025-40243 7.8 HIGH hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
CVE-2025-40241 7.8 HIGH erofs: fix crafted invalid cases for encoded extents
CVE-2025-40233 7.8 HIGH ocfs2: clear extent cache after moving/defragmenting extents
CVE-2025-40216 7.8 HIGH io_uring/rsrc: don't rely on user vaddr alignment
CVE-2025-40215 7.8 HIGH xfrm: delete x->tunnel as we delete x
CVE-2025-40240 7.5 HIGH sctp: avoid NULL dereference when chunk data buffer is missing
CVE-2025-40242 7.0 HIGH gfs2: Fix unlikely race in gdlm_put_lock

Showing top 20 of 53 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-40258

No comments yet

Leave a comment