Answer in brief
CVE-2025-40258 records a Critical severity (CVSS 9.8) vulnerability in mptcp: fix race condition in mptcp_schedule_work(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3b1d6210a9577369103330b0d802b0bf74b65e7f <f865e6595acf33083168db76921e66ace8bf0e5b || >=3b1d6210a9577369103330b0d802b0bf74b65e7f <99908e2d601236842d705d5fd04fb349577316f5 || >=3b1d6210a9577369103330b0d802b0bf74b65e7f <db4f7968a75250ca6c4ed70d0a78beabb2dcee18 || >=3b1d6210a9577369103330b0d802b0bf74b65e7f <8f9ba1a99a89feef9b5867c15a0141a97e893309 || >=3b1d6210a9577369103330b0d802b0bf74b65e7f <ac28dfddedf6f209190950fc71bcff65ec4ab47b || >=3b1d6210a9577369103330b0d802b0bf74b65e7f <3fc7723ed01d1130d4bf7063c50e0af60ecccbb4 || >=3b1d6210a9577369103330b0d802b0bf74b65e7f <035bca3f017ee9dea3a5a756e77a6f7138cc6eea | f865e6595acf33083168db76921e66ace8bf0e5b, 99908e2d601236842d705d5fd04fb349577316f5, db4f7968a75250ca6c4ed70d0a78beabb2dcee18, 8f9ba1a99a89feef9b5867c15a0141a97e893309, ac28dfddedf6f209190950fc71bcff65ec4ab47b, 3fc7723ed01d1130d4bf7063c50e0af60ecccbb4, 035bca3f017ee9dea3a5a756e77a6f7138cc6eea |
| Linux/Linuxgeneric | 5.7 | Not reported |
| Siemens/RUGGEDCOM RST2428Pgeneric | >=0 <V4.0 | V4.0 |
Published upstream
Dec 4, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Quoted source text, attributed separately from HOL analysis.