CVE-2025-39955

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server-side TCP Fast Open socket as a new client before the TFO socket completes 3WHS: 1. accept() 2. connect(AF_UNSPEC) 3. connect() to another destination As of accept(), sk->sk_state is TCP_SYN_RECV, and tcp_disconnect() changes it to TCP_CLOSE and makes connect() possible, which restarts timers. Since tcp_disconnect() forgot to clear tcp_...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 8336886f786fdacbc19b719c1f7ea91eb70706d4 < 7ec092a91ff351dcde89c23e795b73a328274db6, >= 8336886f786fdacbc19b719c1f7ea91eb70706d4 < a4378dedd6e07e62f2fccb17d78c9665718763d0, >= 8336886f786fdacbc19b719c1f7ea91eb70706d4 < 33a4fdf0b4a25f8ce65380c3b0136b407ca57609, >= 8336886f786fdacbc19b719c1f7ea91eb70706d4 < 17d699727577814198d744d6afe54735c6b54c99, >= 8336886f786fdacbc19b719c1f7ea91eb70706d4 < dfd06131107e7b699ef1e2a24ed2f7d17c917753, >= 8336886f786fdacbc19b719c1f7ea91eb70706d4 < fa4749c065644af4db496b338452a69a3e5147d9, >= 8336886f786fdacbc19b719c1f7ea91eb70706d4 < ae313d14b45eca7a6bb29cb9bf396d977e7d28fb, >= 8336886f786fdacbc19b719c1f7ea91eb70706d4 < 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01, >= 3.7, >= V3.1.6, >= 3.7 < 5.4.300, >= 5.5 < 5.10.245, >= 5.11 < 5.15.194, >= 5.16 < 6.1.154, >= 6.2 < 6.6.108, >= 6.7 < 6.12.49, >= 6.13 < 6.16.9, 6.17

Fixed versions

5.4.300, 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Not available