Junglewise Threat Intelligence

CVE-2025-40257: Linux Kernel use-after-free in MPTCP mptcp_pm_del_add_timer

CVE-2025-40257 · Severity: info · Published 2025-12-04

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation, which allows multiple network paths for a single connection. A race condition in the path management component could lead to a system crash or unpredictable behavior when the system attempts to stop a timer for an address that has already been removed. This issue primarily affects system stability and availability for servers or devices using MPTCP.

Technical details

A use-after-free vulnerability exists in the MPTCP (MultiPath TCP) implementation within the Linux kernel. The function mptcp_pm_del_add_timer() can attempt to synchronize and stop a timer (sk_stop_timer_sync) on an entry that has already been freed by another task. This race condition occurs because the entry lacks sufficient RCU (Read-Copy-Update) protection during the deletion process. An attacker could potentially trigger this race via network traffic that manipulates MPTCP options, leading to a kernel panic (as evidenced by KASAN reports of slab-use-after-free in __timer_delete_sync). The fix introduces RCU protection to ensure the entry remains valid during the timer deletion process.

Affected products

  • Linux Linux Kernel Fixed in versions 6.1.120, 6.6.64, 6.11.11, 6.12.2 and later

Timeline

  • 2025-11-17: patched: Initial patch authored
  • 2025-12-04: advisory: CVE-2025-40257 disclosed

References

Related threats