LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work()

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-40258 is a Linux kernel flaw in Multipath TCP work scheduling. A race can let scheduled work finish before the socket reference is safely held, leading to a use-after-free condition. The public record does not provide CVSS, impact rating, or confirmed exploitation.

Executive priority

Treat as a tracked kernel maintenance item until vendors provide severity and product mapping. Prioritize internet-facing, multi-tenant, appliance, and critical infrastructure systems, but do not label this emergency based on the provided evidence alone.

Technical view

The bug is in mptcp_schedule_work(). The vulnerable sequence schedules work before taking sk_refcnt; mptcp_worker() can run and complete before sock_hold(), causing refcount addition on a freed socket. The fix changes ordering to hold the socket before scheduling work and release it if scheduling fails.

Likely exposure

Exposure is most likely on Linux systems or products using affected kernel lines with MPTCP code present. The bundle lists Linux affected version entries including 5.7, 5.10.247, 5.15.197, 6.1.159, 6.6.118, 6.12.60, 6.17.10, and 6.18. Distro and appliance mapping requires vendor confirmation.

Exploitation context

The issue was reported by syzbot, indicating automated kernel fuzzing found the condition. The provided sources do not state public exploit availability, active exploitation, required privileges, or remote reachability. KEV is false, so active exploitation should not be assumed.

Researcher notes

Key uncertainty is exploitability context. Sources show a race-driven use-after-free in MPTCP timer/work handling and stable backports, but not the attacker path, privilege boundary, or impact class. Validate against exact kernel branch, configuration, and vendor patch status.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable MPTCP fixes.
  • Map distro or appliance kernels to the upstream fixed commits.
  • Review Siemens SSA-253495 if Siemens products are in scope.
  • If no vendor fix is available, request vendor guidance for compensating controls.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded systems.
  • Check package changelogs for the referenced kernel.org stable commits.
  • Confirm whether MPTCP is enabled or available in exposed environments.
  • Monitor vendor advisories for corrected package versions and product-specific impact.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40258 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3b1d6210a9577369103330b0d802b0bf74b65e7f, 3b1d6210a9577369103330b0d802b0bf74b65e7f, 3b1d6210a9577369103330b0d802b0bf74b65e7f, 3b1d6210a9577369103330b0d802b0bf74b65e7f, 3b1d6210a9577369103330b0d802b0bf74b65e7f, 3b1d6210a9577369103330b0d802b0bf74b65e7f, 3b1d6210a9577369103330b0d802b0bf74b65e7funaffected
LinuxLinux5.7, 0, 5.10.247, 5.15.197, 6.1.159, 6.6.118, 6.12.60, 6.17.10, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.