SECUFOCUSNOW
Home›CVE index›CVE-2025-40258
Review reviewCritical

CVE-2025-40258

Linux Linux, RUGGEDCOM RST2428P

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addit...

CVSS
9.8
EPSS
0.45%
37.2% percentile
CISA KEV
Not listed
Published
2025.12.05
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.45%
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addit...

Affected product and versions

Product
Linux Linux, RUGGEDCOM RST2428P
Affected versions
>= 3b1d6210a9577369103330b0d802b0bf74b65e7f < f865e6595acf33083168db76921e66ace8bf0e5b, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f < 99908e2d601236842d705d5fd04fb349577316f5, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f < db4f7968a75250ca6c4ed70d0a78beabb2dcee18, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f < 8f9ba1a99a89feef9b5867c15a0141a97e893309, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f < ac28dfddedf6f209190950fc71bcff65ec4ab47b, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f < 3fc7723ed01d1130d4bf7063c50e0af60ecccbb4, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f < 035bca3f017ee9dea3a5a756e77a6f7138cc6eea, >= 5.7, < V4.0
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, RUGGEDCOM RST2428P and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available