github - ghsa-q2wv-3qj8-h2hq

ghsa-q2wv-3qj8-h2hq

Vulnerability from github

Published

2025-11-12 12:30

Modified

2025-11-12 12:30

Details

In the Linux kernel, the following vulnerability has been resolved:

mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().

mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-40133"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-12T11:15:42Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().\n\nmptcp_active_enable() is called from subflow_finish_connect(),\nwhich is icsk-\u003eicsk_af_ops-\u003esk_rx_dst_set() and it\u0027s not always\nunder RCU.\n\nUsing sk_dst_get(sk)-\u003edev could trigger UAF.\n\nLet\u0027s use __sk_dst_get() and dst_dev_rcu().",
  "id": "GHSA-q2wv-3qj8-h2hq",
  "modified": "2025-11-12T12:30:27Z",
  "published": "2025-11-12T12:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40133"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/893c49a78d9f85e4b8081b908fb7c407d018106a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ad16235c9d3ef7ec17c109ff39b7504f49d17072"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cc976ec9e38bb79409de3261ba1dbb6868e2a53e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2025-40133 (GCVE-0-2025-40133)

Vulnerability from cvelistv5

Published

2025-11-12 10:23

Modified

2025-11-12 10:23

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu().

References

URL

Tags

	https://git.kernel.org/stable/c/ad16235c9d3ef7ec17c109ff39b7504f49d17072
	https://git.kernel.org/stable/c/cc976ec9e38bb79409de3261ba1dbb6868e2a53e
	https://git.kernel.org/stable/c/893c49a78d9f85e4b8081b908fb7c407d018106a

Impacted products

Vendor

Product

Version

Version: 27069e7cb3d1cea9377069266acf19b9cc5ad0ae
Version: 27069e7cb3d1cea9377069266acf19b9cc5ad0ae
Version: 27069e7cb3d1cea9377069266acf19b9cc5ad0ae

Version: 6.12

Show details on NVD website

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad16235c9d3ef7ec17c109ff39b7504f49d17072",
              "status": "affected",
              "version": "27069e7cb3d1cea9377069266acf19b9cc5ad0ae",
              "versionType": "git"
            },
            {
              "lessThan": "cc976ec9e38bb79409de3261ba1dbb6868e2a53e",
              "status": "affected",
              "version": "27069e7cb3d1cea9377069266acf19b9cc5ad0ae",
              "versionType": "git"
            },
            {
              "lessThan": "893c49a78d9f85e4b8081b908fb7c407d018106a",
              "status": "affected",
              "version": "27069e7cb3d1cea9377069266acf19b9cc5ad0ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18-rc1",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().\n\nmptcp_active_enable() is called from subflow_finish_connect(),\nwhich is icsk-\u003eicsk_af_ops-\u003esk_rx_dst_set() and it\u0027s not always\nunder RCU.\n\nUsing sk_dst_get(sk)-\u003edev could trigger UAF.\n\nLet\u0027s use __sk_dst_get() and dst_dev_rcu()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-12T10:23:22.498Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad16235c9d3ef7ec17c109ff39b7504f49d17072"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc976ec9e38bb79409de3261ba1dbb6868e2a53e"
        },
        {
          "url": "https://git.kernel.org/stable/c/893c49a78d9f85e4b8081b908fb7c407d018106a"
        }
      ],
      "title": "mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40133",
    "datePublished": "2025-11-12T10:23:22.498Z",
    "dateReserved": "2025-04-16T07:20:57.170Z",
    "dateUpdated": "2025-11-12T10:23:22.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.