CVE-2025-40258

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix race condition in mptcp_schedule_work()

syzbot reported use-after-free in mptcp_schedule_work() [1]

Issue here is that mptcp_schedule_work() schedules a work,

then gets a refcount on sk->sk_refcnt if the work was scheduled.

This refcount will be released by mptcp_worker().

[A] if (schedule_work(...)) {

[B] sock_hold(sk);

return true;

}

Problem is that mptcp_worker() can run immediately and complete before [B]

We need instead :

sock_hold(sk);

if (schedule_work(...))

return true;

sock_put(sk);

[1]

refcount_t: addition on 0; use-after-free.

WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25

Call Trace:

<TASK>

__refcount_add include/linux/refcount.h:-1 [inline]

__refcount_inc include/linux/refcount.h:366 [inline]

refcount_inc include/linux/refcount.h:383 [inline]

sock_hold include/net/sock.h:816 [inline]

mptcp_sc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References