CVE-2025-39955 (GCVE-0-2025-39955)

Vulnerability from cvelistv5 – Published: 2025-10-09 09:47 – Updated: 2026-06-11 18:44
VLAI
Title
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server-side TCP Fast Open socket as a new client before the TFO socket completes 3WHS: 1. accept() 2. connect(AF_UNSPEC) 3. connect() to another destination As of accept(), sk->sk_state is TCP_SYN_RECV, and tcp_disconnect() changes it to TCP_CLOSE and makes connect() possible, which restarts timers. Since tcp_disconnect() forgot to clear tcp_sk(sk)->fastopen_rsk, the retransmit timer triggered the warning and the intended packet was not retransmitted. Let's call reqsk_fastopen_remove() in tcp_disconnect(). [0]: WARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7)) Modules linked in: CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7)) Code: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 <0f> 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e RSP: 0018:ffffc900002f8d40 EFLAGS: 00010293 RAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017 RDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400 RBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8 R10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540 R13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0 FS: 0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0 Call Trace: <IRQ> tcp_write_timer (net/ipv4/tcp_timer.c:738) call_timer_fn (kernel/time/timer.c:1747) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372) timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135) tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035) __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1)) tmigr_handle_remote (kernel/time/timer_migration.c:1096) handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580) irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35)) </IRQ>
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8336886f786fdacbc19b719c1f7ea91eb70706d4 , < 7ec092a91ff351dcde89c23e795b73a328274db6 (git)
Affected: 8336886f786fdacbc19b719c1f7ea91eb70706d4 , < a4378dedd6e07e62f2fccb17d78c9665718763d0 (git)
Affected: 8336886f786fdacbc19b719c1f7ea91eb70706d4 , < 33a4fdf0b4a25f8ce65380c3b0136b407ca57609 (git)
Affected: 8336886f786fdacbc19b719c1f7ea91eb70706d4 , < 17d699727577814198d744d6afe54735c6b54c99 (git)
Affected: 8336886f786fdacbc19b719c1f7ea91eb70706d4 , < dfd06131107e7b699ef1e2a24ed2f7d17c917753 (git)
Affected: 8336886f786fdacbc19b719c1f7ea91eb70706d4 , < fa4749c065644af4db496b338452a69a3e5147d9 (git)
Affected: 8336886f786fdacbc19b719c1f7ea91eb70706d4 , < ae313d14b45eca7a6bb29cb9bf396d977e7d28fb (git)
Affected: 8336886f786fdacbc19b719c1f7ea91eb70706d4 , < 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 (git)
Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 5.4.300 , ≤ 5.4.* (semver)
Unaffected: 5.10.245 , ≤ 5.10.* (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.154 , ≤ 6.1.* (semver)
Unaffected: 6.6.108 , ≤ 6.6.* (semver)
Unaffected: 6.12.49 , ≤ 6.12.* (semver)
Unaffected: 6.16.9 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39955",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:49.740642Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:16.576Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ec092a91ff351dcde89c23e795b73a328274db6",
              "status": "affected",
              "version": "8336886f786fdacbc19b719c1f7ea91eb70706d4",
              "versionType": "git"
            },
            {
              "lessThan": "a4378dedd6e07e62f2fccb17d78c9665718763d0",
              "status": "affected",
              "version": "8336886f786fdacbc19b719c1f7ea91eb70706d4",
              "versionType": "git"
            },
            {
              "lessThan": "33a4fdf0b4a25f8ce65380c3b0136b407ca57609",
              "status": "affected",
              "version": "8336886f786fdacbc19b719c1f7ea91eb70706d4",
              "versionType": "git"
            },
            {
              "lessThan": "17d699727577814198d744d6afe54735c6b54c99",
              "status": "affected",
              "version": "8336886f786fdacbc19b719c1f7ea91eb70706d4",
              "versionType": "git"
            },
            {
              "lessThan": "dfd06131107e7b699ef1e2a24ed2f7d17c917753",
              "status": "affected",
              "version": "8336886f786fdacbc19b719c1f7ea91eb70706d4",
              "versionType": "git"
            },
            {
              "lessThan": "fa4749c065644af4db496b338452a69a3e5147d9",
              "status": "affected",
              "version": "8336886f786fdacbc19b719c1f7ea91eb70706d4",
              "versionType": "git"
            },
            {
              "lessThan": "ae313d14b45eca7a6bb29cb9bf396d977e7d28fb",
              "status": "affected",
              "version": "8336886f786fdacbc19b719c1f7ea91eb70706d4",
              "versionType": "git"
            },
            {
              "lessThan": "45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01",
              "status": "affected",
              "version": "8336886f786fdacbc19b719c1f7ea91eb70706d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.154",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect().\n\nsyzbot reported the splat below where a socket had tcp_sk(sk)-\u003efastopen_rsk\nin the TCP_ESTABLISHED state. [0]\n\nsyzbot reused the server-side TCP Fast Open socket as a new client before\nthe TFO socket completes 3WHS:\n\n  1. accept()\n  2. connect(AF_UNSPEC)\n  3. connect() to another destination\n\nAs of accept(), sk-\u003esk_state is TCP_SYN_RECV, and tcp_disconnect() changes\nit to TCP_CLOSE and makes connect() possible, which restarts timers.\n\nSince tcp_disconnect() forgot to clear tcp_sk(sk)-\u003efastopen_rsk, the\nretransmit timer triggered the warning and the intended packet was not\nretransmitted.\n\nLet\u0027s call reqsk_fastopen_remove() in tcp_disconnect().\n\n[0]:\nWARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nModules linked in:\nCPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nCode: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 \u003c0f\u003e 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e\nRSP: 0018:ffffc900002f8d40 EFLAGS: 00010293\nRAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017\nRDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400\nRBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8\nR10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540\nR13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0\nFS:  0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0\nCall Trace:\n \u003cIRQ\u003e\n tcp_write_timer (net/ipv4/tcp_timer.c:738)\n call_timer_fn (kernel/time/timer.c:1747)\n __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372)\n timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135)\n tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035)\n __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1))\n tmigr_handle_remote (kernel/time/timer_migration.c:1096)\n handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580)\n irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696)\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35))\n \u003c/IRQ\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:39:39.433Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ec092a91ff351dcde89c23e795b73a328274db6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4378dedd6e07e62f2fccb17d78c9665718763d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/33a4fdf0b4a25f8ce65380c3b0136b407ca57609"
        },
        {
          "url": "https://git.kernel.org/stable/c/17d699727577814198d744d6afe54735c6b54c99"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfd06131107e7b699ef1e2a24ed2f7d17c917753"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa4749c065644af4db496b338452a69a3e5147d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae313d14b45eca7a6bb29cb9bf396d977e7d28fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01"
        }
      ],
      "title": "tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39955",
    "datePublished": "2025-10-09T09:47:33.556Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-06-11T18:44:16.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39955",
      "date": "2026-06-26",
      "epss": "0.00141",
      "percentile": "0.03783"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39955\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-09T10:15:36.220\",\"lastModified\":\"2026-02-26T23:10:35.193\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect().\\n\\nsyzbot reported the splat below where a socket had tcp_sk(sk)-\u003efastopen_rsk\\nin the TCP_ESTABLISHED state. [0]\\n\\nsyzbot reused the server-side TCP Fast Open socket as a new client before\\nthe TFO socket completes 3WHS:\\n\\n  1. accept()\\n  2. connect(AF_UNSPEC)\\n  3. connect() to another destination\\n\\nAs of accept(), sk-\u003esk_state is TCP_SYN_RECV, and tcp_disconnect() changes\\nit to TCP_CLOSE and makes connect() possible, which restarts timers.\\n\\nSince tcp_disconnect() forgot to clear tcp_sk(sk)-\u003efastopen_rsk, the\\nretransmit timer triggered the warning and the intended packet was not\\nretransmitted.\\n\\nLet\u0027s call reqsk_fastopen_remove() in tcp_disconnect().\\n\\n[0]:\\nWARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\\nModules linked in:\\nCPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary)\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\nRIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\\nCode: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 \u003c0f\u003e 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e\\nRSP: 0018:ffffc900002f8d40 EFLAGS: 00010293\\nRAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017\\nRDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400\\nRBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8\\nR10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540\\nR13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0\\nFS:  0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0\\nCall Trace:\\n \u003cIRQ\u003e\\n tcp_write_timer (net/ipv4/tcp_timer.c:738)\\n call_timer_fn (kernel/time/timer.c:1747)\\n __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372)\\n timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135)\\n tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035)\\n __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1))\\n tmigr_handle_remote (kernel/time/timer_migration.c:1096)\\n handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580)\\n irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696)\\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35))\\n \u003c/IRQ\u003e\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7\",\"versionEndExcluding\":\"5.4.300\",\"matchCriteriaId\":\"EF3A9D25-ED48-454C-90BC-70C637BF3185\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.245\",\"matchCriteriaId\":\"B0E443AF-02FC-45A1-9CD7-3F80A65F1A15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.194\",\"matchCriteriaId\":\"CF862263-DC8D-4324-A52A-DA1D7880B35A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.154\",\"matchCriteriaId\":\"E49CD91E-FC55-45B0-BB63-9AD5F5D70CAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.108\",\"matchCriteriaId\":\"A7E8EAEE-7731-4996-9578-696255D61EA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.49\",\"matchCriteriaId\":\"CAA033E9-A2C5-4976-A83E-9804D8FB827F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.9\",\"matchCriteriaId\":\"638DD910-1189-4F5E-98BF-2D436B695112\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E4C5C0-079F-4838-971B-8C503D48FCC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A4516A6-C12E-42A4-8C0E-68AEF3264504\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/17d699727577814198d744d6afe54735c6b54c99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/33a4fdf0b4a25f8ce65380c3b0136b407ca57609\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ec092a91ff351dcde89c23e795b73a328274db6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a4378dedd6e07e62f2fccb17d78c9665718763d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae313d14b45eca7a6bb29cb9bf396d977e7d28fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dfd06131107e7b699ef1e2a24ed2f7d17c917753\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fa4749c065644af4db496b338452a69a3e5147d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39955\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:41:49.740642Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:38:46.298Z\"}}], \"cna\": {\"title\": \"tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect().\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8336886f786fdacbc19b719c1f7ea91eb70706d4\", \"lessThan\": \"7ec092a91ff351dcde89c23e795b73a328274db6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8336886f786fdacbc19b719c1f7ea91eb70706d4\", \"lessThan\": \"a4378dedd6e07e62f2fccb17d78c9665718763d0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8336886f786fdacbc19b719c1f7ea91eb70706d4\", \"lessThan\": \"33a4fdf0b4a25f8ce65380c3b0136b407ca57609\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8336886f786fdacbc19b719c1f7ea91eb70706d4\", \"lessThan\": \"17d699727577814198d744d6afe54735c6b54c99\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8336886f786fdacbc19b719c1f7ea91eb70706d4\", \"lessThan\": \"dfd06131107e7b699ef1e2a24ed2f7d17c917753\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8336886f786fdacbc19b719c1f7ea91eb70706d4\", \"lessThan\": \"fa4749c065644af4db496b338452a69a3e5147d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8336886f786fdacbc19b719c1f7ea91eb70706d4\", \"lessThan\": \"ae313d14b45eca7a6bb29cb9bf396d977e7d28fb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8336886f786fdacbc19b719c1f7ea91eb70706d4\", \"lessThan\": \"45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/tcp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.300\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.245\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.194\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.108\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.49\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/tcp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7ec092a91ff351dcde89c23e795b73a328274db6\"}, {\"url\": \"https://git.kernel.org/stable/c/a4378dedd6e07e62f2fccb17d78c9665718763d0\"}, {\"url\": \"https://git.kernel.org/stable/c/33a4fdf0b4a25f8ce65380c3b0136b407ca57609\"}, {\"url\": \"https://git.kernel.org/stable/c/17d699727577814198d744d6afe54735c6b54c99\"}, {\"url\": \"https://git.kernel.org/stable/c/dfd06131107e7b699ef1e2a24ed2f7d17c917753\"}, {\"url\": \"https://git.kernel.org/stable/c/fa4749c065644af4db496b338452a69a3e5147d9\"}, {\"url\": \"https://git.kernel.org/stable/c/ae313d14b45eca7a6bb29cb9bf396d977e7d28fb\"}, {\"url\": \"https://git.kernel.org/stable/c/45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect().\\n\\nsyzbot reported the splat below where a socket had tcp_sk(sk)-\u003efastopen_rsk\\nin the TCP_ESTABLISHED state. [0]\\n\\nsyzbot reused the server-side TCP Fast Open socket as a new client before\\nthe TFO socket completes 3WHS:\\n\\n  1. accept()\\n  2. connect(AF_UNSPEC)\\n  3. connect() to another destination\\n\\nAs of accept(), sk-\u003esk_state is TCP_SYN_RECV, and tcp_disconnect() changes\\nit to TCP_CLOSE and makes connect() possible, which restarts timers.\\n\\nSince tcp_disconnect() forgot to clear tcp_sk(sk)-\u003efastopen_rsk, the\\nretransmit timer triggered the warning and the intended packet was not\\nretransmitted.\\n\\nLet\u0027s call reqsk_fastopen_remove() in tcp_disconnect().\\n\\n[0]:\\nWARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\\nModules linked in:\\nCPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary)\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\nRIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\\nCode: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 \u003c0f\u003e 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e\\nRSP: 0018:ffffc900002f8d40 EFLAGS: 00010293\\nRAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017\\nRDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400\\nRBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8\\nR10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540\\nR13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0\\nFS:  0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0\\nCall Trace:\\n \u003cIRQ\u003e\\n tcp_write_timer (net/ipv4/tcp_timer.c:738)\\n call_timer_fn (kernel/time/timer.c:1747)\\n __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372)\\n timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135)\\n tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035)\\n __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1))\\n tmigr_handle_remote (kernel/time/timer_migration.c:1096)\\n handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580)\\n irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696)\\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35))\\n \u003c/IRQ\u003e\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.300\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.245\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.194\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.154\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.108\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.49\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.9\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"3.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:39:39.433Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39955\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:16.576Z\", \"dateReserved\": \"2025-04-16T07:20:57.149Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-10-09T09:47:33.556Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.