Executive brief
A vulnerability was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation, which allows multiple network paths for a single connection. A race condition in the path management component could lead to a system crash or unpredictable behavior when the system attempts to stop a timer for an address that has already been removed. This issue primarily affects system stability and availability for servers or devices using MPTCP.
Technical details
A use-after-free vulnerability exists in the MPTCP (MultiPath TCP) implementation within the Linux kernel. The function mptcp_pm_del_add_timer() can attempt to synchronize and stop a timer (sk_stop_timer_sync) on an entry that has already been freed by another task. This race condition occurs because the entry lacks sufficient RCU (Read-Copy-Update) protection during the deletion process. An attacker could potentially trigger this race via network traffic that manipulates MPTCP options, leading to a kernel panic (as evidenced by KASAN reports of slab-use-after-free in __timer_delete_sync). The fix introduces RCU protection to ensure the entry remains valid during the timer deletion process.
Affected products
- Linux Linux Kernel Fixed in versions 6.1.120, 6.6.64, 6.11.11, 6.12.2 and later
Timeline
- 2025-11-17: patched: Initial patch authored
- 2025-12-04: advisory: CVE-2025-40257 disclosed
References
- https://git.kernel.org/stable/c/385ddc0f008f24d1e7d03be998b3a98a37bd29ff
- https://git.kernel.org/stable/c/426358d9be7ce3518966422f87b96f1bad27295f
- https://git.kernel.org/stable/c/6d3275d4ca62e2c02e1b7e8cd32db59df91c14b7
- https://git.kernel.org/stable/c/9be29f8e7ce4e147e56caac2c3a0ce3573cf9c17
- https://git.kernel.org/stable/c/bbbd75346c8e6490b19c2ba90f38ea66ccf352b2
- https://git.kernel.org/stable/c/c602cc344b4b8d41515fec3ffa98457ac963ee12
- https://git.kernel.org/stable/c/e2d1ad207174a7cd7903dd27a00db4b2dfa6c64b