CVE-2025-40257

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix a race in mptcp_pm_del_add_timer()

mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer)

while another might have free entry already, as reported by syzbot.

Add RCU protection to fix this issue.

Also change confusing add_timer variable with stop_timer boolean.

syzbot report:

BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616

Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44

CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025

Workqueue: events mptcp_worker

Call Trace:

<TASK>

dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120

print_address_description mm/kasan/report.c:378 [inline]

print_report+0xca/0x240 mm/kasan/report.c:482

kasan_report+0x118/0x150 mm/kasan/report.c:595

__timer_delete_sync+0x372/0

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References