GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40280 (GCVE-0-2025-40280)

Vulnerability from cvelistv5 – Published: 2025-12-06 21:51 – Updated: 2026-08-05 12:09
VLAI
Title
tipc: Fix use-after-free in tipc_mon_reinit_self().
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_mon_reinit_self(). syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0] The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL. tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work(). Let's hold RTNL in tipc_net_finalize_work(). [0]: BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989 CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events tipc_net_finalize_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568 kasan_check_byte include/linux/kasan.h:399 [inline] lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline] rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline] rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244 rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243 write_lock_bh include/linux/rwlock_rt.h:99 [inline] tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718 tipc_net_finalize+0x115/0x190 net/tipc/net.c:140 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 6089: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657 tipc_enable_bearer net/tipc/bearer.c:357 [inline] __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047 __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline] tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393 tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline] tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x508/0x820 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/ ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 19:38 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 28845c28f842e9e55e75b2c116bff714bb039055 , < 5f541300b02ef8b2af34f6f7d41ce617f3571e88 (git)
Affected: 46cb01eeeb86fca6afe24dda1167b0cb95424e29 , < b2e77c789c234e7fe49057d2ced8f32e2d2c7901 (git)
Affected: 46cb01eeeb86fca6afe24dda1167b0cb95424e29 , < 51b8f0ab888f8aa5dfac954918864eeda8c12c19 (git)
Affected: 46cb01eeeb86fca6afe24dda1167b0cb95424e29 , < 499b5fa78d525c4450ebb76db83207db71efea77 (git)
Affected: 46cb01eeeb86fca6afe24dda1167b0cb95424e29 , < c92dbf85627b5c29e52d9c120a24e785801716df (git)
Affected: 46cb01eeeb86fca6afe24dda1167b0cb95424e29 , < f0104977fed25ebe001fd63dab2b6b7fefad3373 (git)
Affected: 46cb01eeeb86fca6afe24dda1167b0cb95424e29 , < fdf7c4c9af4f246323ce854e84b6aec198d49f7e (git)
Affected: 46cb01eeeb86fca6afe24dda1167b0cb95424e29 , < 0725e6afb55128be21a2ca36e9674f573ccec173 (git)
Affected: 295c9b554f6dfcd2d368fae6e6fa22ee5b79c123 (git)
Affected: 5.4.15 , < 5.4.302 (semver)
Affected: 4.19.99 , < 4.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.4.302 , ≤ 5.4.* (semver)
Unaffected: 5.10.247 , ≤ 5.10.* (semver)
Unaffected: 5.15.197 , ≤ 5.15.* (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.117 , ≤ 6.6.* (semver)
Unaffected: 6.12.59 , ≤ 6.12.* (semver)
Unaffected: 6.17.9 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens RUGGEDCOM RST2428P Affected: 0 , < V4.0 (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:19.721Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:38:24.070026Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:38:34.983Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f541300b02ef8b2af34f6f7d41ce617f3571e88",
              "status": "affected",
              "version": "28845c28f842e9e55e75b2c116bff714bb039055",
              "versionType": "git"
            },
            {
              "lessThan": "b2e77c789c234e7fe49057d2ced8f32e2d2c7901",
              "status": "affected",
              "version": "46cb01eeeb86fca6afe24dda1167b0cb95424e29",
              "versionType": "git"
            },
            {
              "lessThan": "51b8f0ab888f8aa5dfac954918864eeda8c12c19",
              "status": "affected",
              "version": "46cb01eeeb86fca6afe24dda1167b0cb95424e29",
              "versionType": "git"
            },
            {
              "lessThan": "499b5fa78d525c4450ebb76db83207db71efea77",
              "status": "affected",
              "version": "46cb01eeeb86fca6afe24dda1167b0cb95424e29",
              "versionType": "git"
            },
            {
              "lessThan": "c92dbf85627b5c29e52d9c120a24e785801716df",
              "status": "affected",
              "version": "46cb01eeeb86fca6afe24dda1167b0cb95424e29",
              "versionType": "git"
            },
            {
              "lessThan": "f0104977fed25ebe001fd63dab2b6b7fefad3373",
              "status": "affected",
              "version": "46cb01eeeb86fca6afe24dda1167b0cb95424e29",
              "versionType": "git"
            },
            {
              "lessThan": "fdf7c4c9af4f246323ce854e84b6aec198d49f7e",
              "status": "affected",
              "version": "46cb01eeeb86fca6afe24dda1167b0cb95424e29",
              "versionType": "git"
            },
            {
              "lessThan": "0725e6afb55128be21a2ca36e9674f573ccec173",
              "status": "affected",
              "version": "46cb01eeeb86fca6afe24dda1167b0cb95424e29",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "295c9b554f6dfcd2d368fae6e6fa22ee5b79c123",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.302",
              "status": "affected",
              "version": "5.4.15",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.99",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.302",
                  "versionStartIncluding": "5.4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.59",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.99",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Fix use-after-free in tipc_mon_reinit_self().\n\nsyzbot reported use-after-free of tipc_net(net)-\u003emonitors[]\nin tipc_mon_reinit_self(). [0]\n\nThe array is protected by RTNL, but tipc_mon_reinit_self()\niterates over it without RTNL.\n\ntipc_mon_reinit_self() is called from tipc_net_finalize(),\nwhich is always under RTNL except for tipc_net_finalize_work().\n\nLet\u0027s hold RTNL in tipc_net_finalize_work().\n\n[0]:\nBUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\nBUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\nRead of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989\n\nCPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025\nWorkqueue: events tipc_net_finalize_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568\n kasan_check_byte include/linux/kasan.h:399 [inline]\n lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\n rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]\n rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]\n rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244\n rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243\n write_lock_bh include/linux/rwlock_rt.h:99 [inline]\n tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718\n tipc_net_finalize+0x115/0x190 net/tipc/net.c:140\n process_one_work kernel/workqueue.c:3236 [inline]\n process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400\n kthread+0x70e/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nAllocated by task 6089:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:388 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657\n tipc_enable_bearer net/tipc/bearer.c:357 [inline]\n __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047\n __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]\n tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393\n tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]\n tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321\n genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:729\n ____sys_sendmsg+0x508/0x820 net/socket.c:2614\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\n __sys_sendmsg net/socket.c:2700 [inline]\n __do_sys_sendmsg net/socket.c:2705 [inline]\n __se_sys_sendmsg net/socket.c:2703 [inline]\n __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF race is driven by local netlink/configuration operations \u2014 enabling a TIPC bearer and tearing it down (netdev unregister) \u2014 with the finalize work self-scheduled by the address-trial timeout; the freeing side cannot be driven by a remote peer, so local access is required.\nAC:L - The attacker controls both sides of the race (bearer enable/finalize work vs. concurrent bearer disable/monitor free) and can repeat the operations to win the window, as demonstrated by the syzbot reproducer.\nPR:L - All TIPC bearer operations require GENL_UNS_ADMIN_PERM (CAP_NET_ADMIN), which is obtainable by an unprivileged user in a user+network namespace (unshare -Urn) since TIPC is netns-aware.\nUI:N - The race is triggered entirely by the attacker\u0027s own syscalls and a kernel timer/workqueue; no action from any other user is needed.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; standard kernel privilege escalation does not cross a CVSS scope boundary.\nC:H - A use-after-free lets the attacker reallocate the freed monitor object with controlled contents, and the code reads pointers/fields from it, enabling disclosure of kernel memory.\nI:H - The UAF dereferences `mon-\u003eself` from the freed object and writes a controlled node address (`mon-\u003eself-\u003eaddr = ...`); with heap grooming this yields an arbitrary-write primitive exploitable for control-flow hijack.\nA:H - The use-after-free reliably causes kernel memory corruption and oops/panic, taking down the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:10.959Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f541300b02ef8b2af34f6f7d41ce617f3571e88"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e77c789c234e7fe49057d2ced8f32e2d2c7901"
        },
        {
          "url": "https://git.kernel.org/stable/c/51b8f0ab888f8aa5dfac954918864eeda8c12c19"
        },
        {
          "url": "https://git.kernel.org/stable/c/499b5fa78d525c4450ebb76db83207db71efea77"
        },
        {
          "url": "https://git.kernel.org/stable/c/c92dbf85627b5c29e52d9c120a24e785801716df"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0104977fed25ebe001fd63dab2b6b7fefad3373"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdf7c4c9af4f246323ce854e84b6aec198d49f7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0725e6afb55128be21a2ca36e9674f573ccec173"
        }
      ],
      "title": "tipc: Fix use-after-free in tipc_mon_reinit_self().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40280",
    "datePublished": "2025-12-06T21:51:04.091Z",
    "dateReserved": "2025-04-16T07:20:57.184Z",
    "dateUpdated": "2026-08-05T12:09:10.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40280",
      "date": "2026-09-16",
      "epss": "0.00146",
      "percentile": "0.04255"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40280\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-06T22:15:55.973\",\"lastModified\":\"2026-07-30T06:24:25.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: Fix use-after-free in tipc_mon_reinit_self().\\n\\nsyzbot reported use-after-free of tipc_net(net)-\u003emonitors[]\\nin tipc_mon_reinit_self(). [0]\\n\\nThe array is protected by RTNL, but tipc_mon_reinit_self()\\niterates over it without RTNL.\\n\\ntipc_mon_reinit_self() is called from tipc_net_finalize(),\\nwhich is always under RTNL except for tipc_net_finalize_work().\\n\\nLet\u0027s hold RTNL in tipc_net_finalize_work().\\n\\n[0]:\\nBUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\\nBUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\\nRead of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989\\n\\nCPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025\\nWorkqueue: events tipc_net_finalize_work\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\\n print_address_description mm/kasan/report.c:378 [inline]\\n print_report+0xca/0x240 mm/kasan/report.c:482\\n kasan_report+0x118/0x150 mm/kasan/report.c:595\\n __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568\\n kasan_check_byte include/linux/kasan.h:399 [inline]\\n lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842\\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\\n _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\\n rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]\\n rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]\\n rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244\\n rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243\\n write_lock_bh include/linux/rwlock_rt.h:99 [inline]\\n tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718\\n tipc_net_finalize+0x115/0x190 net/tipc/net.c:140\\n process_one_work kernel/workqueue.c:3236 [inline]\\n process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319\\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400\\n kthread+0x70e/0x8a0 kernel/kthread.c:463\\n ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148\\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\\n \u003c/TASK\u003e\\n\\nAllocated by task 6089:\\n kasan_save_stack mm/kasan/common.c:47 [inline]\\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\\n poison_kmalloc_redzone mm/kasan/common.c:388 [inline]\\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405\\n kasan_kmalloc include/linux/kasan.h:260 [inline]\\n __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407\\n kmalloc_noprof include/linux/slab.h:905 [inline]\\n kzalloc_noprof include/linux/slab.h:1039 [inline]\\n tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657\\n tipc_enable_bearer net/tipc/bearer.c:357 [inline]\\n __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047\\n __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]\\n tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393\\n tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]\\n tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321\\n genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115\\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\\n genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210\\n netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552\\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\\n netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346\\n netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896\\n sock_sendmsg_nosec net/socket.c:714 [inline]\\n __sock_sendmsg+0x21c/0x270 net/socket.c:729\\n ____sys_sendmsg+0x508/0x820 net/socket.c:2614\\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\\n __sys_sendmsg net/socket.c:2700 [inline]\\n __do_sys_sendmsg net/socket.c:2705 [inline]\\n __se_sys_sendmsg net/socket.c:2703 [inline]\\n __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703\\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n do_syscall_64+0xfa/0x3b0 arch/\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tipc/net.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"28845c28f842e9e55e75b2c116bff714bb039055\",\"lessThan\":\"5f541300b02ef8b2af34f6f7d41ce617f3571e88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46cb01eeeb86fca6afe24dda1167b0cb95424e29\",\"lessThan\":\"b2e77c789c234e7fe49057d2ced8f32e2d2c7901\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46cb01eeeb86fca6afe24dda1167b0cb95424e29\",\"lessThan\":\"51b8f0ab888f8aa5dfac954918864eeda8c12c19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46cb01eeeb86fca6afe24dda1167b0cb95424e29\",\"lessThan\":\"499b5fa78d525c4450ebb76db83207db71efea77\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46cb01eeeb86fca6afe24dda1167b0cb95424e29\",\"lessThan\":\"c92dbf85627b5c29e52d9c120a24e785801716df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46cb01eeeb86fca6afe24dda1167b0cb95424e29\",\"lessThan\":\"f0104977fed25ebe001fd63dab2b6b7fefad3373\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46cb01eeeb86fca6afe24dda1167b0cb95424e29\",\"lessThan\":\"fdf7c4c9af4f246323ce854e84b6aec198d49f7e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46cb01eeeb86fca6afe24dda1167b0cb95424e29\",\"lessThan\":\"0725e6afb55128be21a2ca36e9674f573ccec173\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"295c9b554f6dfcd2d368fae6e6fa22ee5b79c123\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.15\",\"lessThan\":\"5.4.302\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.99\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tipc/net.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.302\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.247\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.197\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.159\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.117\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.59\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.9\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-16T19:38:24.070026Z\",\"id\":\"CVE-2025-40280\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0725e6afb55128be21a2ca36e9674f573ccec173\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/499b5fa78d525c4450ebb76db83207db71efea77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/51b8f0ab888f8aa5dfac954918864eeda8c12c19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5f541300b02ef8b2af34f6f7d41ce617f3571e88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b2e77c789c234e7fe49057d2ced8f32e2d2c7901\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c92dbf85627b5c29e52d9c120a24e785801716df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0104977fed25ebe001fd63dab2b6b7fefad3373\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fdf7c4c9af4f246323ce854e84b6aec198d49f7e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:37:59+00:00",
      "cve": "CVE-2025-40280",
      "id": "CVE-2025-40280",
      "initial_release_date": "2025-12-06T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: Fix use-after-free in tipc_mon_reinit_self()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40280.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T01:54:09Z",
      "cve": "CVE-2025-40280",
      "id": "CVE-2025-40280",
      "initial_release_date": "2025-12-08T00:23:07Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "467",
      "product_status:known_not_affected": "187",
      "product_status:recommended": "584",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40280",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40280.json",
      "version": "49"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM RST2428P\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-06-02T13:00:19.721Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-40280\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T19:38:24.070026Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T19:38:30.117Z\"}}], \"cna\": {\"title\": \"tipc: Fix use-after-free in tipc_mon_reinit_self().\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF race is driven by local netlink/configuration operations \\u2014 enabling a TIPC bearer and tearing it down (netdev unregister) \\u2014 with the finalize work self-scheduled by the address-trial timeout; the freeing side cannot be driven by a remote peer, so local access is required.\\nAC:L - The attacker controls both sides of the race (bearer enable/finalize work vs. concurrent bearer disable/monitor free) and can repeat the operations to win the window, as demonstrated by the syzbot reproducer.\\nPR:L - All TIPC bearer operations require GENL_UNS_ADMIN_PERM (CAP_NET_ADMIN), which is obtainable by an unprivileged user in a user+network namespace (unshare -Urn) since TIPC is netns-aware.\\nUI:N - The race is triggered entirely by the attacker\u0027s own syscalls and a kernel timer/workqueue; no action from any other user is needed.\\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; standard kernel privilege escalation does not cross a CVSS scope boundary.\\nC:H - A use-after-free lets the attacker reallocate the freed monitor object with controlled contents, and the code reads pointers/fields from it, enabling disclosure of kernel memory.\\nI:H - The UAF dereferences `mon-\u003eself` from the freed object and writes a controlled node address (`mon-\u003eself-\u003eaddr = ...`); with heap grooming this yields an arbitrary-write primitive exploitable for control-flow hijack.\\nA:H - The use-after-free reliably causes kernel memory corruption and oops/panic, taking down the system.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"28845c28f842e9e55e75b2c116bff714bb039055\", \"lessThan\": \"5f541300b02ef8b2af34f6f7d41ce617f3571e88\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"46cb01eeeb86fca6afe24dda1167b0cb95424e29\", \"lessThan\": \"b2e77c789c234e7fe49057d2ced8f32e2d2c7901\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"46cb01eeeb86fca6afe24dda1167b0cb95424e29\", \"lessThan\": \"51b8f0ab888f8aa5dfac954918864eeda8c12c19\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"46cb01eeeb86fca6afe24dda1167b0cb95424e29\", \"lessThan\": \"499b5fa78d525c4450ebb76db83207db71efea77\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"46cb01eeeb86fca6afe24dda1167b0cb95424e29\", \"lessThan\": \"c92dbf85627b5c29e52d9c120a24e785801716df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"46cb01eeeb86fca6afe24dda1167b0cb95424e29\", \"lessThan\": \"f0104977fed25ebe001fd63dab2b6b7fefad3373\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"46cb01eeeb86fca6afe24dda1167b0cb95424e29\", \"lessThan\": \"fdf7c4c9af4f246323ce854e84b6aec198d49f7e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"46cb01eeeb86fca6afe24dda1167b0cb95424e29\", \"lessThan\": \"0725e6afb55128be21a2ca36e9674f573ccec173\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"295c9b554f6dfcd2d368fae6e6fa22ee5b79c123\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.4.15\", \"lessThan\": \"5.4.302\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.99\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/tipc/net.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.302\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.247\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.197\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.117\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.59\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.17.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/tipc/net.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5f541300b02ef8b2af34f6f7d41ce617f3571e88\"}, {\"url\": \"https://git.kernel.org/stable/c/b2e77c789c234e7fe49057d2ced8f32e2d2c7901\"}, {\"url\": \"https://git.kernel.org/stable/c/51b8f0ab888f8aa5dfac954918864eeda8c12c19\"}, {\"url\": \"https://git.kernel.org/stable/c/499b5fa78d525c4450ebb76db83207db71efea77\"}, {\"url\": \"https://git.kernel.org/stable/c/c92dbf85627b5c29e52d9c120a24e785801716df\"}, {\"url\": \"https://git.kernel.org/stable/c/f0104977fed25ebe001fd63dab2b6b7fefad3373\"}, {\"url\": \"https://git.kernel.org/stable/c/fdf7c4c9af4f246323ce854e84b6aec198d49f7e\"}, {\"url\": \"https://git.kernel.org/stable/c/0725e6afb55128be21a2ca36e9674f573ccec173\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: Fix use-after-free in tipc_mon_reinit_self().\\n\\nsyzbot reported use-after-free of tipc_net(net)-\u003emonitors[]\\nin tipc_mon_reinit_self(). [0]\\n\\nThe array is protected by RTNL, but tipc_mon_reinit_self()\\niterates over it without RTNL.\\n\\ntipc_mon_reinit_self() is called from tipc_net_finalize(),\\nwhich is always under RTNL except for tipc_net_finalize_work().\\n\\nLet\u0027s hold RTNL in tipc_net_finalize_work().\\n\\n[0]:\\nBUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\\nBUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\\nRead of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989\\n\\nCPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025\\nWorkqueue: events tipc_net_finalize_work\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\\n print_address_description mm/kasan/report.c:378 [inline]\\n print_report+0xca/0x240 mm/kasan/report.c:482\\n kasan_report+0x118/0x150 mm/kasan/report.c:595\\n __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568\\n kasan_check_byte include/linux/kasan.h:399 [inline]\\n lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842\\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\\n _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\\n rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]\\n rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]\\n rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244\\n rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243\\n write_lock_bh include/linux/rwlock_rt.h:99 [inline]\\n tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718\\n tipc_net_finalize+0x115/0x190 net/tipc/net.c:140\\n process_one_work kernel/workqueue.c:3236 [inline]\\n process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319\\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400\\n kthread+0x70e/0x8a0 kernel/kthread.c:463\\n ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148\\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\\n \u003c/TASK\u003e\\n\\nAllocated by task 6089:\\n kasan_save_stack mm/kasan/common.c:47 [inline]\\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\\n poison_kmalloc_redzone mm/kasan/common.c:388 [inline]\\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405\\n kasan_kmalloc include/linux/kasan.h:260 [inline]\\n __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407\\n kmalloc_noprof include/linux/slab.h:905 [inline]\\n kzalloc_noprof include/linux/slab.h:1039 [inline]\\n tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657\\n tipc_enable_bearer net/tipc/bearer.c:357 [inline]\\n __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047\\n __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]\\n tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393\\n tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]\\n tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321\\n genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115\\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\\n genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210\\n netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552\\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\\n netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346\\n netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896\\n sock_sendmsg_nosec net/socket.c:714 [inline]\\n __sock_sendmsg+0x21c/0x270 net/socket.c:729\\n ____sys_sendmsg+0x508/0x820 net/socket.c:2614\\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\\n __sys_sendmsg net/socket.c:2700 [inline]\\n __do_sys_sendmsg net/socket.c:2705 [inline]\\n __se_sys_sendmsg net/socket.c:2703 [inline]\\n __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703\\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n do_syscall_64+0xfa/0x3b0 arch/\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.302\", \"versionStartIncluding\": \"5.4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.247\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.197\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.159\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.117\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.59\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17.9\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.99\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:09:10.959Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-40280\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:09:10.959Z\", \"dateReserved\": \"2025-04-16T07:20:57.184Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-12-06T21:51:04.091Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.