SECUFOCUSNOW
Home›CVE index›CVE-2025-40257
Review reviewCritical

CVE-2025-40257

Linux Linux, RUGGEDCOM RST2428P

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusing add_timer variable with stop_timer boolean. syzbot report: BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44 CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0...

CVSS
9.8
EPSS
0.45%
37.2% percentile
CISA KEV
Not listed
Published
2025.12.05
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.45%
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusing add_timer variable with stop_timer boolean. syzbot report: BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44 CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0...

Affected product and versions

Product
Linux Linux, RUGGEDCOM RST2428P
Affected versions
>= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < 9be29f8e7ce4e147e56caac2c3a0ce3573cf9c17, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < e2d1ad207174a7cd7903dd27a00db4b2dfa6c64b, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < 385ddc0f008f24d1e7d03be998b3a98a37bd29ff, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < c602cc344b4b8d41515fec3ffa98457ac963ee12, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < 6d3275d4ca62e2c02e1b7e8cd32db59df91c14b7, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < bbbd75346c8e6490b19c2ba90f38ea66ccf352b2, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < 426358d9be7ce3518966422f87b96f1bad27295f, >= 5.10, < V4.0
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, RUGGEDCOM RST2428P and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available