{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40186", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.177Z", "datePublished": "2025-11-12T21:56:29.033Z", "dateUpdated": "2026-08-05T12:08:24.563Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:24.563Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().\n\nsyzbot reported the splat below in tcp_conn_request(). [0]\n\nIf a listener is close()d while a TFO socket is being processed in\ntcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk\nand calls inet_child_forget(), which calls tcp_disconnect() for the\nTFO socket.\n\nAfter the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),\nwhere reqsk_put() is called due to !reqsk->sk.\n\nThen, reqsk_fastopen_remove() in tcp_conn_request() decrements the\nlast req->rsk_refcnt and frees reqsk, and __reqsk_free() at the\ndrop_and_free label causes the refcount underflow for the listener\nand double-free of the reqsk.\n\nLet's remove reqsk_fastopen_remove() in tcp_conn_request().\n\nNote that other callers make sure tp->fastopen_rsk is not NULL.\n\n[0]:\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)\nModules linked in:\nCPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:refcount_warn_saturate (lib/refcount.c:28)\nCode: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6\nRSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246\nRAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900\nRDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280\nRBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280\nR10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100\nR13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8\nFS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0\nCall Trace:\n \n tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)\n tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)\n tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)\n tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)\n ip6_input (net/ipv6/ip6_input.c:500)\n ipv6_rcv (net/ipv6/ip6_input.c:311)\n __netif_receive_skb (net/core/dev.c:6104)\n process_backlog (net/core/dev.c:6456)\n __napi_poll (net/core/dev.c:7506)\n net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)\n handle_softirqs (kernel/softirq.c:579)\n do_softirq (kernel/softirq.c:480)\n " } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is in the TCP/IP stack's inbound SYN-processing path (tcp_v6_rcv → tcp_rcv_state_process → tcp_conn_request), triggered by a received TCP Fast Open SYN packet from a remote peer.\nAC:H - Triggering requires the listener socket to transition out of TCP_LISTEN (a local close()/shutdown()) at the exact moment an inbound TFO SYN is being processed; a remote attacker cannot control the timing of that close, so success depends on conditions beyond their control.\nPR:N - The TFO SYN is processed pre-connection with no authentication; an unauthenticated remote attacker needs no privileges to reach tcp_conn_request().\nUI:N - The bug is triggered purely by network packet processing racing with a listener close; no victim interaction is required.\nS:U - The corruption stays within the kernel's own memory/security authority (request_sock slab and listener refcount); no VM/IOMMU/sandbox boundary is crossed.\nC:H - The refcount underflow yields a use-after-free/double-free of a request_sock, giving an attacker control over freed-object contents that can be leveraged to read adjacent kernel memory.\nI:H - The double-free/UAF is a heap-corruption primitive that can be groomed into an arbitrary-write / control-flow-hijack, so integrity impact is high.\nA:H - The refcount underflow and double-free reliably corrupt kernel memory and crash the kernel (oops/panic in softirq context), a high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/tcp_input.c" ], "versions": [ { "version": "7ec092a91ff351dcde89c23e795b73a328274db6", "lessThan": "e359b742eac1eac75cff4e38ee2e8cea492acd9b", "status": "affected", "versionType": "git" }, { "version": "a4378dedd6e07e62f2fccb17d78c9665718763d0", "lessThan": "ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d", "status": "affected", "versionType": "git" }, { "version": "33a4fdf0b4a25f8ce65380c3b0136b407ca57609", "lessThan": "eb85ad5f23268d64b037bfb545cbcba3752f90c7", "status": "affected", "versionType": "git" }, { "version": "17d699727577814198d744d6afe54735c6b54c99", "lessThan": "643a94b0cf767325e953591c212be2eb826b9d7f", "status": "affected", "versionType": "git" }, { "version": "dfd06131107e7b699ef1e2a24ed2f7d17c917753", "lessThan": "422c1c173c39bbbae1e0eaaf8aefe40b2596233b", "status": "affected", "versionType": "git" }, { "version": "fa4749c065644af4db496b338452a69a3e5147d9", "lessThan": "c11ace909e873118295e9eb22dc8c58b0b50eb32", "status": "affected", "versionType": "git" }, { "version": "45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01", "lessThan": "64dc47a13aa3d9daf7cec29b44dca8e22a6aea15", "status": "affected", "versionType": "git" }, { "version": "45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01", "lessThan": "2e7cbbbe3d61c63606994b7ff73c72537afe2e1c", "status": "affected", "versionType": "git" }, { "version": "ae313d14b45eca7a6bb29cb9bf396d977e7d28fb", "status": "affected", "versionType": "git" }, { "version": "5.4.300", "lessThan": "5.4.301", "status": "affected", "versionType": "semver" }, { "version": "5.10.245", "lessThan": "5.10.246", "status": "affected", "versionType": "semver" }, { "version": "5.15.194", "lessThan": "5.15.195", "status": "affected", "versionType": "semver" }, { "version": "6.1.154", "lessThan": "6.1.157", "status": "affected", "versionType": "semver" }, { "version": "6.6.108", "lessThan": "6.6.113", "status": "affected", "versionType": "semver" }, { "version": "6.12.49", "lessThan": "6.12.54", "status": "affected", "versionType": "semver" }, { "version": "6.16.9", "lessThan": "6.17", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/tcp_input.c" ], "versions": [ { "version": "6.17", "status": "affected" }, { "version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.195", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.157", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.113", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.54", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.4", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.300", "versionEndExcluding": "5.4.301" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.245", "versionEndExcluding": "5.10.246" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.194", "versionEndExcluding": "5.15.195" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.154", "versionEndExcluding": "6.1.157" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.108", "versionEndExcluding": "6.6.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.49", "versionEndExcluding": "6.12.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.17.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e359b742eac1eac75cff4e38ee2e8cea492acd9b" }, { "url": "https://git.kernel.org/stable/c/ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d" }, { "url": "https://git.kernel.org/stable/c/eb85ad5f23268d64b037bfb545cbcba3752f90c7" }, { "url": "https://git.kernel.org/stable/c/643a94b0cf767325e953591c212be2eb826b9d7f" }, { "url": "https://git.kernel.org/stable/c/422c1c173c39bbbae1e0eaaf8aefe40b2596233b" }, { "url": "https://git.kernel.org/stable/c/c11ace909e873118295e9eb22dc8c58b0b50eb32" }, { "url": "https://git.kernel.org/stable/c/64dc47a13aa3d9daf7cec29b44dca8e22a6aea15" }, { "url": "https://git.kernel.org/stable/c/2e7cbbbe3d61c63606994b7ff73c72537afe2e1c" } ], "title": "tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().", "x_generator": { "engine": "bippy-1.2.0" } } } }