tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 0001024
CVE-2025-40186
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-40186
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7ec092a91ff351dcde89c23e795b73a328274db6",
"lessThan": "e359b742eac1eac75cff4e38ee2e8cea492acd9b",
"versionType": "git"
},
{
"status": "affected",
"version": "a4378dedd6e07e62f2fccb17d78c9665718763d0",
"lessThan": "ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d",
"versionType": "git"
},
{
"status": "affected",
"version": "33a4fdf0b4a25f8ce65380c3b0136b407ca57609",
"lessThan": "eb85ad5f23268d64b037bfb545cbcba3752f90c7",
"versionType": "git"
},
{
"status": "affected",
"version": "17d699727577814198d744d6afe54735c6b54c99",
"lessThan": "643a94b0cf767325e953591c212be2eb826b9d7f",
"versionType": "git"
},
{
"status": "affected",
"version": "dfd06131107e7b699ef1e2a24ed2f7d17c917753",
"lessThan": "422c1c173c39bbbae1e0eaaf8aefe40b2596233b",
"versionType": "git"
},
{
"status": "affected",
"version": "fa4749c065644af4db496b338452a69a3e5147d9",
"lessThan": "c11ace909e873118295e9eb22dc8c58b0b50eb32",
"versionType": "git"
},
{
"status": "affected",
"version": "45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01",
"lessThan": "64dc47a13aa3d9daf7cec29b44dca8e22a6aea15",
"versionType": "git"
},
{
"status": "affected",
"version": "45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01",
"lessThan": "2e7cbbbe3d61c63606994b7ff73c72537afe2e1c",
"versionType": "git"
},
{
"status": "affected",
"version": "ae313d14b45eca7a6bb29cb9bf396d977e7d28fb",
"versionType": "git"
},
{
"status": "affected",
"version": "5.4.300",
"lessThan": "5.4.301",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.245",
"lessThan": "5.10.246",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.194",
"lessThan": "5.15.195",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.154",
"lessThan": "6.1.157",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.108",
"lessThan": "6.6.113",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.49",
"lessThan": "6.12.54",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.16.9",
"lessThan": "6.17",
"versionType": "semver"
}
],
"programFiles": [
"net/ipv4/tcp_input.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.301",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.246",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.195",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.157",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.113",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.54",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.17.4",
"versionType": "semver",
"lessThanOrEqual": "6.17.*"
},
{
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/tcp_input.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-40186
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30689 · Revision 1
- Added to Heist Feed
- Publisher date