Skip to main content

Linux Kernel CVE-2025-40133

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Network-reachable but a hard-to-win race (AC:H) with no auth (PR:N); realistic impact is kernel crash (A:H) with only speculative, low-confidence C/I from the UAF.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 09:08 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 09:07 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.1 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().

mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

AnalysisAI

Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.

Technical ContextAI

The affected component is MPTCP, the kernel's Multipath TCP implementation that lets a single logical connection use multiple TCP subflows across paths. When an active (client-initiated) subflow completes its handshake, subflow_finish_connect() runs as the icsk->icsk_af_ops->sk_rx_dst_set() callback, and this path is not guaranteed to hold the RCU read lock. mptcp_active_enable() previously used sk_dst_get(sk)->dev to read the outgoing device from the socket's destination (dst) cache; without RCU protection the referenced dst entry (and its net_device) can be freed concurrently, yielding a use-after-free. The upstream fix replaces this with __sk_dst_get() plus dst_dev_rcu() to obtain the device safely. No CWE was assigned in the input, but the root cause is a classic UAF/race-condition class (CWE-416 / CWE-362) driven by missing RCU synchronization around shared dst state.

Affected ProductsAI

The Linux kernel MPTCP subsystem is affected across versions that include the pre-fix mptcp_active_enable() using sk_dst_get(sk)->dev. No CPE strings or explicit version ranges were provided in the input, so exact vulnerable/fixed kernel version numbers are not enumerated here; the fix is delivered through the stable tree. Relevant upstream fix commits are at https://git.kernel.org/stable/c/893c49a78d9f85e4b8081b908fb7c407d018106a, https://git.kernel.org/stable/c/ad16235c9d3ef7ec17c109ff39b7504f49d17072, and https://git.kernel.org/stable/c/cc976ec9e38bb79409de3261ba1dbb6868e2a53e, indicating backports to multiple stable branches.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update from your distribution that incorporates the MPTCP dst_dev_rcu()/__sk_dst_get() correction, referencing the stable commits at git.kernel.org (893c49a7, ad16235c, cc976ec9). Because no tagged release version was provided in the input, track your distribution's advisory (Debian/Ubuntu/RHEL/SUSE) for the exact patched package and reboot into the fixed kernel or apply the corresponding live-patch. As a compensating control where immediate patching is not possible, disable Multipath TCP if it is not required (e.g., sysctl net.mptcp.enabled=0), which closes the vulnerable code path entirely; the trade-off is loss of MPTCP multipath functionality for any application relying on it. Avoid initiating MPTCP client connections on untrusted networks until patched, though this is a partial control since the race is triggered by normal connection completion rather than attacker-supplied input.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.1/base-os-container:latest Container suse/sl-micro/6.1/kvm-os-container:latest Container suse/sl-micro/6.1/rt-os-container:latest Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected

Share

CVE-2025-40133 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy