CVE-2025-40133 (GCVE-0-2025-40133)

Vulnerability from cvelistv5 – Published: 2025-11-12 10:23 – Updated: 2026-08-05 12:07
VLAI
Title
mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu().
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 27069e7cb3d1cea9377069266acf19b9cc5ad0ae , < ad16235c9d3ef7ec17c109ff39b7504f49d17072 (git)
Affected: 27069e7cb3d1cea9377069266acf19b9cc5ad0ae , < cc976ec9e38bb79409de3261ba1dbb6868e2a53e (git)
Affected: 27069e7cb3d1cea9377069266acf19b9cc5ad0ae , < 893c49a78d9f85e4b8081b908fb7c407d018106a (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.55 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad16235c9d3ef7ec17c109ff39b7504f49d17072",
              "status": "affected",
              "version": "27069e7cb3d1cea9377069266acf19b9cc5ad0ae",
              "versionType": "git"
            },
            {
              "lessThan": "cc976ec9e38bb79409de3261ba1dbb6868e2a53e",
              "status": "affected",
              "version": "27069e7cb3d1cea9377069266acf19b9cc5ad0ae",
              "versionType": "git"
            },
            {
              "lessThan": "893c49a78d9f85e4b8081b908fb7c407d018106a",
              "status": "affected",
              "version": "27069e7cb3d1cea9377069266acf19b9cc5ad0ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().\n\nmptcp_active_enable() is called from subflow_finish_connect(),\nwhich is icsk-\u003eicsk_af_ops-\u003esk_rx_dst_set() and it\u0027s not always\nunder RCU.\n\nUsing sk_dst_get(sk)-\u003edev could trigger UAF.\n\nLet\u0027s use __sk_dst_get() and dst_dev_rcu()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The stale `dst-\u003edev` dereference executes while processing a remote peer\u0027s SYN-ACK \u2014 `tcp_finish_connect()` \u2192 `icsk_af_ops-\u003esk_rx_dst_set()` \u2192 `subflow_finish_connect()` \u2192 `mptcp_active_enable()` \u2014 so remote network data drives entry into the vulnerable code, and the peer also controls the MP_CAPABLE/blackhole state that unlocks the guarded block. Any MPTCP-enabled host making outbound connections (mobile/carrier stacks, mptcpize\u0027d services, MPTCP proxies) is exposed to a malicious or on-path server.\nAC:H - The attacker controls one side of the race (when the SYN-ACK arrives and thus when `dst-\u003edev` is read), but the other side requires the route\u0027s `net_device` to be concurrently unregistered so `dst_dev_put()`/`netdev_ref_replace()` drops the last reference and `free_netdev()` runs \u2014 a local netdev-teardown event a remote peer can neither induce nor time, as is landing the SYN-ACK in the socket backlog (non-RCU process context) rather than softirq.\nPR:N - The vulnerable code runs during the TCP/MPTCP handshake itself, before any application-level authentication or credential exchange, so the remote peer needs no privileges or account of any kind on the target.\nUI:N - Outbound MPTCP connections are made automatically by daemons, mobile connectivity stacks, and proxies without any human action, and an on-path attacker can simply inject the MP_CAPABLE SYN-ACK for a connection the host initiates on its own.\nS:U - The use-after-free is on a kernel `struct net_device` and its effects stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of a freed, heap-sprayable `net_device`, and a reclaimed slab can be groomed with attacker-influenced data, giving a read primitive over reclaimed kernel memory; the value read (`dev-\u003eflags \u0026 IFF_LOOPBACK`) further acts as an oracle since it determines whether `active_disable_times` is cleared, which is observable through subsequent MPTCP fallback behaviour and the MPTCP MIB counters.\nI:H - A use-after-free on a `net_device` is a heap-corruption primitive whose reclaimed contents are attacker-influenceable via spraying, and here freed memory directly steers a kernel state write (`atomic_set(\u0026pernet-\u003eactive_disable_times, 0)`), letting uncontrolled reclaimed data modify per-namespace MPTCP protocol state and, once the slab is groomed, be escalated toward arbitrary write and control-flow hijack.\nA:H - Dereferencing a freed `net_device` \u2014 allocated with `kvzalloc` and potentially unmapped on free \u2014 reliably produces a kernel oops or panic even when not weaponized, and the trigger can be retried indefinitely for a persistent denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:59.353Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad16235c9d3ef7ec17c109ff39b7504f49d17072"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc976ec9e38bb79409de3261ba1dbb6868e2a53e"
        },
        {
          "url": "https://git.kernel.org/stable/c/893c49a78d9f85e4b8081b908fb7c407d018106a"
        }
      ],
      "title": "mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40133",
    "datePublished": "2025-11-12T10:23:22.498Z",
    "dateReserved": "2025-04-16T07:20:57.170Z",
    "dateUpdated": "2026-08-05T12:07:59.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40133",
      "date": "2026-09-28",
      "epss": "0.00479",
      "percentile": "0.3891"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/ctrl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ad16235c9d3ef7ec17c109ff39b7504f49d17072",
                    "status": "affected",
                    "version": "27069e7cb3d1cea9377069266acf19b9cc5ad0ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cc976ec9e38bb79409de3261ba1dbb6868e2a53e",
                    "status": "affected",
                    "version": "27069e7cb3d1cea9377069266acf19b9cc5ad0ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "893c49a78d9f85e4b8081b908fb7c407d018106a",
                    "status": "affected",
                    "version": "27069e7cb3d1cea9377069266acf19b9cc5ad0ae",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/ctrl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().\n\nmptcp_active_enable() is called from subflow_finish_connect(),\nwhich is icsk-\u003eicsk_af_ops-\u003esk_rx_dst_set() and it\u0027s not always\nunder RCU.\n\nUsing sk_dst_get(sk)-\u003edev could trigger UAF.\n\nLet\u0027s use __sk_dst_get() and dst_dev_rcu()."
          }
        ],
        "id": "CVE-2025-40133",
        "lastModified": "2026-07-30T06:24:12.963",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-11-12T11:15:42.993",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/893c49a78d9f85e4b8081b908fb7c407d018106a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ad16235c9d3ef7ec17c109ff39b7504f49d17072"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cc976ec9e38bb79409de3261ba1dbb6868e2a53e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:47:53+00:00",
      "cve": "CVE-2025-40133",
      "id": "CVE-2025-40133",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:fixed": "616",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40133.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T02:06:37Z",
      "cve": "CVE-2025-40133",
      "id": "CVE-2025-40133",
      "initial_release_date": "2025-11-14T00:25:09Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "540",
      "product_status:recommended": "196",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40133",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40133.json",
      "version": "27"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.