CVE-2025-40186

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last...

Affected product and versions

Product

Linux

Affected versions

>= 7ec092a91ff351dcde89c23e795b73a328274db6 < e359b742eac1eac75cff4e38ee2e8cea492acd9b, >= a4378dedd6e07e62f2fccb17d78c9665718763d0 < ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d, >= 33a4fdf0b4a25f8ce65380c3b0136b407ca57609 < eb85ad5f23268d64b037bfb545cbcba3752f90c7, >= 17d699727577814198d744d6afe54735c6b54c99 < 643a94b0cf767325e953591c212be2eb826b9d7f, >= dfd06131107e7b699ef1e2a24ed2f7d17c917753 < 422c1c173c39bbbae1e0eaaf8aefe40b2596233b, >= fa4749c065644af4db496b338452a69a3e5147d9 < c11ace909e873118295e9eb22dc8c58b0b50eb32, >= 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 < 64dc47a13aa3d9daf7cec29b44dca8e22a6aea15, >= 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 < 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c, >= ae313d14b45eca7a6bb29cb9bf396d977e7d28fb, >= 5.4.300 < 5.4.301, >= 5.10.245 < 5.10.246, >= 5.15.194 < 5.15.195, >= 6.1.154 < 6.1.157, >= 6.6.108 < 6.6.113, >= 6.12.49 < 6.12.54, >= 6.16.9 < 6.17, >= 6.17

Fixed versions

No verified fixed-version field is available yet

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Not available