Security readout for executives and security teams
Plain-English summary
A race in Linux Multipath TCP can make the kernel access an object after it has been freed. This unsafe memory access may crash or destabilize affected systems. The supplied record rates potential impact as critical, but it does not establish real-world exploitation.
Executive priority
Treat this as an urgent patch-validation item for systems using affected Linux kernels, especially critical or network-facing infrastructure. Prioritize verified vendor updates, but do not represent exploitation as active. Version ambiguity means asset-level confirmation is necessary before declaring systems affected or remediated.
Technical view
Concurrent MPTCP processing can free an address entry while mptcp_pm_del_add_timer() is stopping its timer, producing a slab use-after-free in __timer_delete_sync(). Syzbot reproduced the fault under KASAN. The referenced Linux fixes add RCU protection; the supplied data reports CVSS 9.8 with a network, unauthenticated vector.
Likely exposure
The record lists affected Linux releases spanning 5.10 through 6.18, but its version data does not precisely identify every affected distribution build. Exposure centers on systems containing the vulnerable kernel code and exercising MPTCP. Confirm status using distributor or equipment-vendor advisories rather than version strings alone.
Exploitation context
The issue was discovered through syzbot kernel testing. The supplied bundle marks it absent from KEV and provides no evidence of active exploitation or a public exploit. Although the CVSS vector describes remote, low-complexity, unauthenticated exposure, the available technical evidence demonstrates a race-triggered use-after-free, not confirmed practical compromise.
Researcher notes
The demonstrated condition is a timer-related slab use-after-free caused by lifetime synchronization failure around an MPTCP address entry. The fix adds RCU protection and renames a confusing variable. No CWE is supplied. The source description is truncated, so exploitability prerequisites, reliability, and precise branch boundaries remain incompletely documented.
Mitigation direction
- Inventory running kernel versions and determine where MPTCP is enabled or operationally required.
- Apply vendor kernel updates that incorporate one of the referenced RCU-protection fixes.
- Reboot where required, then confirm the patched kernel is the active running kernel.
- If updates are unavailable, obtain product-specific mitigation guidance from the Linux distributor or equipment vendor.
Validation and detection
- Compare each running kernel build with vendor advisories and the referenced stable fixes.
- Confirm the installed update contains RCU protection for mptcp_pm_del_add_timer().
- Check whether MPTCP is configured or used to refine operational exposure.
- Review kernel crash records for use-after-free traces involving mptcp_pm_del_add_timer or __timer_delete_sync().
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40257 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9be29f8e7ce4e147e56caac2c3a0ce3573cf9c17CVE reference, Linux
- https://git.kernel.org/stable/c/e2d1ad207174a7cd7903dd27a00db4b2dfa6c64bCVE reference, Linux
- https://git.kernel.org/stable/c/385ddc0f008f24d1e7d03be998b3a98a37bd29ffCVE reference, Linux
- https://git.kernel.org/stable/c/c602cc344b4b8d41515fec3ffa98457ac963ee12CVE reference, Linux
- https://git.kernel.org/stable/c/6d3275d4ca62e2c02e1b7e8cd32db59df91c14b7CVE reference, Linux
- https://git.kernel.org/stable/c/bbbd75346c8e6490b19c2ba90f38ea66ccf352b2CVE reference, Linux
- https://git.kernel.org/stable/c/426358d9be7ce3518966422f87b96f1bad27295fCVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.