Executive brief
A race condition was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation. MPTCP is a technology that allows a single network connection to use multiple paths (like Wi-Fi and Cellular) simultaneously to improve performance and reliability. This specific flaw could allow a remote attacker to cause a system crash or unpredictable behavior by triggering a timing issue during network task scheduling.
Technical details
A race condition exists in mptcp_schedule_work() within the Linux kernel's MPTCP protocol implementation. The vulnerability occurs because the code originally scheduled a work item before incrementing the socket reference count (sk_refcnt). If the scheduled worker (mptcp_worker) executed and completed immediately on another CPU, it could release the reference count before the scheduling function had a chance to increment it, leading to a use-after-free or a 'refcount_t: addition on 0' warning. This is reachable via network traffic that triggers MPTCP-level retransmissions or timeout timers. The fix reorders the operations to increment the reference count before scheduling the work, ensuring the socket remains valid throughout the execution.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.11, 6.12
Timeline
- 2025-11-13: patched: Initial patch submitted by Eric Dumazet
- 2025-12-04: disclosed: CVE-2025-40258 published
References
- https://git.kernel.org/stable/c/035bca3f017ee9dea3a5a756e77a6f7138cc6eea
- https://git.kernel.org/stable/c/3fc7723ed01d1130d4bf7063c50e0af60ecccbb4
- https://git.kernel.org/stable/c/8f9ba1a99a89feef9b5867c15a0141a97e893309
- https://git.kernel.org/stable/c/99908e2d601236842d705d5fd04fb349577316f5
- https://git.kernel.org/stable/c/ac28dfddedf6f209190950fc71bcff65ec4ab47b
- https://git.kernel.org/stable/c/db4f7968a75250ca6c4ed70d0a78beabb2dcee18
- https://git.kernel.org/stable/c/f865e6595acf33083168db76921e66ace8bf0e5b