CVE-2025-40133

CVE-2025-40133

High · published November 12, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
42.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().

mptcp_active_enable() is called from subflow_finish_connect(),

which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always

under RCU.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00514 · 42.9th percentile
Published
2025-11-12T16:15Z
References (3)
https://git.kernel.org/stable/c/893c49a78d9f85e4b8081b908fb7c407d018106a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ad16235c9d3ef7ec17c109ff39b7504f49d17072 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cc976ec9e38bb79409de3261ba1dbb6868e2a53e · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 12 NOV 10:23Z
    mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
    cvelistv5