LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40186: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>

HighCVSS 8.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux TCP Fast Open race can mishandle memory when a listening socket closes during connection processing. The resulting reference-count underflow, use-after-free, and double-free may crash the system or potentially enable broader kernel compromise. The sources do not demonstrate successful exploitation.

Executive priority

Treat this as a high-priority kernel maintenance issue for externally reachable or high-value Linux systems. Schedule prompt patching after confirming vendor applicability. Immediate emergency response is not supported by the evidence because exploitation is unconfirmed and the trigger has high complexity.

Technical view

During a listener-close race, tcp_disconnect() removes a TCP Fast Open request and decrements its reference count. tcp_conn_request() then performed the removal again, freeing the request before later cleanup caused an underflow and double-free. The cited stable fixes remove the redundant reqsk_fastopen_remove() call.

Likely exposure

Exposure is plausible where a Linux build contains the vulnerable TCP change without its branch-appropriate stable fix, especially on hosts offering TCP Fast Open. The supplied version fields include counterintuitive adjacent releases, so determine exposure through vendor advisories and patch inclusion rather than version-string matching alone.

Exploitation context

The CVE is not identified as KEV, and the sources report discovery through syzbot rather than real-world attacks. No cited source confirms active exploitation or a public weaponized exploit. The network-reachable trigger requires a higher-complexity race involving TCP Fast Open processing and concurrent listener closure.

Researcher notes

CVSS 3.1 is 8.1 with network access, high complexity, no privileges, and no interaction. Its confidentiality, integrity, and availability ratings represent assessed potential, not demonstrated impact. No CWE is supplied. Version mapping is insufficient for reliable downstream backport analysis, so verify commits or vendor package status.

Mitigation direction

  • Apply a vendor kernel update containing the branch-appropriate cited stable fix.
  • Prioritize internet-facing servers, appliances, and container hosts using TCP Fast Open.
  • Activate the updated kernel according to vendor procedures, typically requiring a reboot.
  • If updates are unavailable, consult vendor guidance; the sources name no supported workaround.

Validation and detection

  • Inventory running kernel and package builds across servers, appliances, and container hosts.
  • Verify vendor changelogs or source history include the appropriate cited stable fix.
  • Confirm the corrected kernel is running, rather than merely installed.
  • Review whether TCP Fast Open is enabled and reachable on listening services.
  • Monitor kernel logs for refcount underflow, use-after-free, or double-free warnings.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40186 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2025-40186Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7ec092a91ff351dcde89c23e795b73a328274db6, a4378dedd6e07e62f2fccb17d78c9665718763d0, 33a4fdf0b4a25f8ce65380c3b0136b407ca57609, 17d699727577814198d744d6afe54735c6b54c99, dfd06131107e7b699ef1e2a24ed2f7d17c917753, fa4749c065644af4db496b338452a69a3e5147d9, 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01, 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01, ae313d14b45eca7a6bb29cb9bf396d977e7d28fb, 5.4.300, 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9unaffected
LinuxLinux6.17, 0, 5.4.301, 5.10.246, 5.15.195, 6.1.157, 6.6.113, 6.12.54, 6.17.4, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.