Junglewise Threat Intelligence

CVE-2025-39955: Linux Kernel state inconsistency in TCP Fast Open disconnect

CVE-2025-39955 · Severity: high · CVSS 7.8 · Published 2025-10-09

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local attacker to cause system instability or potentially gain unauthorized access. The issue occurs when a specific type of network connection (TCP Fast Open) is reused in a way the system does not expect, leading to internal errors. This could impact the reliability of services or the security of data on affected systems, including certain industrial controllers.

Technical details

The vulnerability is a state management flaw in the Linux kernel's TCP stack, specifically within the `tcp_disconnect()` function. When a server-side TCP Fast Open (TFO) socket is reused as a new client before the three-way handshake (3WHS) completes, the kernel fails to clear `tcp_sk(sk)->fastopen_rsk`. This oversight causes the retransmit timer to trigger a kernel warning (`net/ipv4/tcp_timer.c:542`) when the socket state transitions, preventing intended packets from being retransmitted. An attacker with local access can exploit this by performing a specific sequence of `accept()`, `connect(AF_UNSPEC)`, and `connect()` calls to trigger the splat. Patches have been released for various stable kernel branches to include a call to `reqsk_fastopen_remove()` in the disconnect path.

Affected products

  • Linux Linux Kernel 6.17.0-rc5-g201825fb4278
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2025-09-15: disclosed: Initial patch submission by Google engineers
  • 2025-09-17: patched: Mainline kernel patch committed
  • 2025-10-09: advisory: NVD publication date

References

Related threats