{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-40257 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-40257 is a critical use after free vulnerability in Linux, published on 4 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-40257 and fix it if it is affected.\n\nWhat it is: CVE-2025-40257 is a critical use after free vulnerability in Linux, published on 4 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-40257 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-40257/ (Markdown: https://insights.sbomify.com/CVE-2025-40257/index.md)","id":"CVE-2025-40257","markdown":"https://insights.sbomify.com/CVE-2025-40257/index.md","name":"CVE-2025-40257","record":{"aliases":["AZL-71372","BELL-CVE-2025-40257","DEBIAN-CVE-2025-40257","GHSA-q4wq-g3wm-gmfc","ROOT-OS-DEBIAN-12-CVE-2025-40257","ROOT-OS-DEBIAN-13-CVE-2025-40257","ROOT-OS-UBUNTU-2204-CVE-2025-40257","ROOT-OS-UBUNTU-2404-CVE-2025-40257","UBUNTU-CVE-2025-40257"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A race condition in the Linux kernel MPTCP module allows a use-after-free, potentially leading to system crashes or arbitrary code execution.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix a race in mptcp_pm_del_add_timer()\n\nmptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, \u0026entry-\u003eadd_timer)\nwhile another might have free entry already, as reported by syzbot.\n\nAdd RCU protection to fix this issue.\n\nAlso change confusing add_timer variable with stop_timer boolean.\n\nsyzbot report:\n\nBUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616\nRead of size 4 at addr ffff8880311e4150 by task kworker/1:1/44\n\nCPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025\nWorkqueue: events mptcp_worker\nCall Trace:\n \u003cTASK\u003e\n  dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:378 [inline]\n  print_report+0xca/0x240 mm/kasan/report.c:482\n  kasan_report+0x118/0x150 mm/kasan/report.c:595\n  __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616\n  sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631\n  mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362\n  mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174\n  tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361\n  tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441\n  tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931\n  tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374\n  ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205\n  ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239\n  NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\n  NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\n  __netif_receive_skb_one_core net/core/dev.c:6079 [inline]\n  __netif_receive_skb+0x143/0x380 net/core/dev.c:6192\n  process_backlog+0x31e/0x900 net/core/dev.c:6544\n  __napi_poll+0xb6/0x540 net/core/dev.c:7594\n  napi_poll net/core/dev.c:7657 [inline]\n  net_rx_action+0x5f7/0xda0 net/core/dev.c:7784\n  handle_softirqs+0x22f/0x710 kernel/softirq.c:622\n  __do_softirq kernel/softirq.c:656 [inline]\n  __local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302\n  mptcp_pm_send_ack net/mptcp/pm.c:210 [inline]\n mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1\n  mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002\n  mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762\n  process_one_work kernel/workqueue.c:3263 [inline]\n  process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nAllocated by task 44:\n  kasan_save_stack mm/kasan/common.c:56 [inline]\n  kasan_save_track+0x3e/0x80 mm/kasan/common.c:77\n  poison_kmalloc_redzone mm/kasan/common.c:400 [inline]\n  __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417\n  kasan_kmalloc include/linux/kasan.h:262 [inline]\n  __kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748\n  kmalloc_noprof include/linux/slab.h:957 [inline]\n  mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385\n  mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355\n  mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline]\n  __mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529\n  mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008\n  mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762\n  process_one_work kernel/workqueue.c:3263 [inline]\n  process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nFreed by task 6630:\n  kasan_save_stack mm/kasan/common.c:56 [inline]\n  kasan_save_track+0x3e/0x80 mm/kasan/common.c:77\n  __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587\n  kasan_save_free_info mm/kasan/kasan.h:406 [inline]\n  poison_slab_object m\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mptcp: fix a race in mptcp_pm_del_add_timer()","id":"CVE-2025-40257","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2025"},"n_packages":0,"n_references":7,"next":{"headline":"mptcp: fix race condition in mptcp_schedule_work()","id":"CVE-2025-40258"},"packages":[],"prev":{"headline":"xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added","id":"CVE-2025-40256"},"products":["Linux"],"published":"2025-12-04","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A race condition in the Linux kernel MPTCP module allows a use-after-free, potentially leading to system crashes or arbitrary code execution.","url":"https://insights.sbomify.com/CVE-2025-40257/"}