Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause the system to incorrectly delete active network connections. This occurs because the kernel's 'garbage collection' process, which is supposed to clean up unused resources, may mistakenly identify live sockets as dead. This can lead to unexpected service disruptions or application crashes for software relying on local Unix domain sockets.
Technical details
A vulnerability exists in the AF_UNIX garbage collection (GC) mechanism within the Linux kernel. The root cause is a failure to initialize the 'scc_index' in the 'unix_add_edge()' function. When the GC process runs, it uses Tarjan-like SCC (Strongly Connected Components) grouping to identify cyclic references of sockets that can be safely deleted. Because new vertices (sockets) could inherit stale SCC indices from previously freed memory (potentially via heap spraying), the 'unix_vertex_dead()' function may misidentify an active socket as being part of a dead SCC. This leads to the garbage collection of receive queues for alive, in-flight sockets. The fix involves tracking the maximum SCC index and properly initializing new vertices with a unique index.
Affected products
- Linux Linux Kernel Fixed in 6.12, 6.11.10, 6.6.63, 6.1.119, 5.15.173, 5.10.230
Timeline
- 2025-11-09: patched: Initial fix authored by Kuniyuki Iwashima
- 2025-12-04: disclosed: CVE-2025-40214 published
References
- https://git.kernel.org/stable/c/1aa7e40ee850c9053e769957ce6541173891204d
- https://git.kernel.org/stable/c/20003fbb9174121b27bd1da6ebe61542ac4c327d
- https://git.kernel.org/stable/c/4cd8d755c7d4f515dd9abf483316aca2f1b7b0f3
- https://git.kernel.org/stable/c/60e6489f8e3b086bd1130ad4450a2c112e863791
- https://git.kernel.org/stable/c/db81ad20fd8aef7cc7d536c52ee5ea4c1f979128
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html