Executive brief
A vulnerability in the Linux kernel's vsock (VM Sockets) component could allow a local user to cause a system crash or instability. The issue occurs when a network connection is interrupted by a signal or timeout at the exact moment it is being established, leading to memory corruption or invalid system states. This could result in a denial of service, impacting the availability of virtualized environments or systems relying on vsock for communication.
Technical details
A vulnerability exists in the vsock_connect() function of the Linux kernel's af_vsock.c. When a connect() call is interrupted by a signal or timeout after the socket has already transitioned to the SS_CONNECTED state, the kernel incorrectly attempts to disconnect the socket. This behavior creates several race conditions: 1) a race with sendmsg() leading to inconsistent bytes_unsent counters; 2) a race with sockmap placement causing state assumption violations; and 3) a transition from SS_CONNECTED to SS_UNCONNECTED that allows transport changes after establishment. These races can result in use-after-free or null-pointer dereference conditions. The fix ensures that signals or timeouts are ignored if the connection is already established.
Affected products
- Linux Linux kernel All versions prior to 6.13-rc1
Timeline
- 2025-11-19: other: Patch submitted by Michal Luczaj
- 2025-12-04: advisory: CVE-2025-40248 published
References
- https://git.kernel.org/stable/c/002541ef650b742a198e4be363881439bb9d86b4
- https://git.kernel.org/stable/c/3f71753935d648082a8279a97d30efe6b85be680
- https://git.kernel.org/stable/c/5998da5a8208ae9ad7838ba322bccb2bdcd95e81
- https://git.kernel.org/stable/c/67432915145848658149683101104e32f9fd6559
- https://git.kernel.org/stable/c/ab6b19f690d89ae4709fba73a3c4a7911f495b7a
- https://git.kernel.org/stable/c/da664101fb4a0de5cb70d2bae6a650df954df2af
- https://git.kernel.org/stable/c/eeca93f06df89be5a36305b7b9dae1ed65550dfc