CVE-2025-40214

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Initialise scc_index in unix_add_edge().

Quang Le reported that the AF_UNIX GC could garbage-collect a

receive queue of an alive in-flight socket, with a nice repro.

The repro consists of three stages.

1)

1-a. Create a single cyclic reference with many sockets

1-b. close() all sockets

1-c. Trigger GC

2)

2-a. Pass sk-A to an embryo sk-B

2-b. Pass sk-X to sk-X

2-c. Trigger GC

3)

3-a. accept() the embryo sk-B

3-b. Pass sk-B to sk-C

3-c. close() the in-flight sk-A

3-d. Trigger GC

As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,

and unix_walk_scc() groups them into two different SCCs:

unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)

unix_sk(sk-X)->vertex->scc_index = 3

Once GC completes, unix_graph_grouped is set to true.

Also, unix_graph_maybe_cyclic is set to true due to sk-X's

cyclic self-reference, which makes close() trigge

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References