Answer in brief
CVE-2025-40186 records a Unknown severity vulnerability in tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2025-40186 records a Unknown severity vulnerability in tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7ec092a91ff351dcde89c23e795b73a328274db6 <e359b742eac1eac75cff4e38ee2e8cea492acd9b || >=a4378dedd6e07e62f2fccb17d78c9665718763d0 <ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d || >=33a4fdf0b4a25f8ce65380c3b0136b407ca57609 <eb85ad5f23268d64b037bfb545cbcba3752f90c7 || >=17d699727577814198d744d6afe54735c6b54c99 <643a94b0cf767325e953591c212be2eb826b9d7f || >=dfd06131107e7b699ef1e2a24ed2f7d17c917753 <422c1c173c39bbbae1e0eaaf8aefe40b2596233b || >=fa4749c065644af4db496b338452a69a3e5147d9 <c11ace909e873118295e9eb22dc8c58b0b50eb32 || >=45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 <64dc47a13aa3d9daf7cec29b44dca8e22a6aea15 || >=45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 <2e7cbbbe3d61c63606994b7ff73c72537afe2e1c || ae313d14b45eca7a6bb29cb9bf396d977e7d28fb || >=5.4.300 <5.4.301 || >=5.10.245 <5.10.246 || >=5.15.194 <5.15.195 || >=6.1.154 <6.1.157 || >=6.6.108 <6.6.113 || >=6.12.49 <6.12.54 || >=6.16.9 <6.17 | e359b742eac1eac75cff4e38ee2e8cea492acd9b, ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d, eb85ad5f23268d64b037bfb545cbcba3752f90c7, 643a94b0cf767325e953591c212be2eb826b9d7f, 422c1c173c39bbbae1e0eaaf8aefe40b2596233b, c11ace909e873118295e9eb22dc8c58b0b50eb32, 64dc47a13aa3d9daf7cec29b44dca8e22a6aea15, 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c, 5.4.301, 5.10.246, 5.15.195, 6.1.157, 6.6.113, 6.12.54, 6.17 |
| Linux/Linuxgeneric | 6.17 | Not reported |
Published upstream
Nov 12, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7ec092a91ff351dcde89c23e795b73a328274db6 <e359b742eac1eac75cff4e38ee2e8cea492acd9b || >=a4378dedd6e07e62f2fccb17d78c9665718763d0 <ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d || >=33a4fdf0b4a25f8ce65380c3b0136b407ca57609 <eb85ad5f23268d64b037bfb545cbcba3752f90c7 || >=17d699727577814198d744d6afe54735c6b54c99 <643a94b0cf767325e953591c212be2eb826b9d7f || >=dfd06131107e7b699ef1e2a24ed2f7d17c917753 <422c1c173c39bbbae1e0eaaf8aefe40b2596233b || >=fa4749c065644af4db496b338452a69a3e5147d9 <c11ace909e873118295e9eb22dc8c58b0b50eb32 || >=45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 <64dc47a13aa3d9daf7cec29b44dca8e22a6aea15 || >=45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 <2e7cbbbe3d61c63606994b7ff73c72537afe2e1c || ae313d14b45eca7a6bb29cb9bf396d977e7d28fb || >=5.4.300 <5.4.301 || >=5.10.245 <5.10.246 || >=5.15.194 <5.15.195 || >=6.1.154 <6.1.157 || >=6.6.108 <6.6.113 || >=6.12.49 <6.12.54 || >=6.16.9 <6.17 | e359b742eac1eac75cff4e38ee2e8cea492acd9b, ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d, eb85ad5f23268d64b037bfb545cbcba3752f90c7, 643a94b0cf767325e953591c212be2eb826b9d7f, 422c1c173c39bbbae1e0eaaf8aefe40b2596233b, c11ace909e873118295e9eb22dc8c58b0b50eb32, 64dc47a13aa3d9daf7cec29b44dca8e22a6aea15, 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c, 5.4.301, 5.10.246, 5.15.195, 6.1.157, 6.6.113, 6.12.54, 6.17 |
| Linux/Linuxgeneric | 6.17 | Not reported |
Published upstream
Nov 12, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
Quoted source text, attributed separately from HOL analysis.