In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call… (CVE-2025-40257)
A critical race condition vulnerability in the Linux kernel's multipath TCP (mptcp) implementation was resolved. The function mptcp_pm_del_add_timer() could call sk_stop_timer_sync() on a timer entry that might have already been freed by another thread, leading to a use-after-free condition. This issue was detected by syzbot and fixed by adding RCU protection to prevent concurrent access to freed memory. The vulnerability could result in kernel memory corruption and potentially allow an attacker to cause denial of service or escalate privileges.
AI Analysis
Technical Summary
CVE-2025-40257 addresses a race condition in the Linux kernel's multipath TCP (mptcp) code, specifically in the mptcp_pm_del_add_timer() function. The function could invoke sk_stop_timer_sync() on a timer entry that another thread might have already freed, causing a use-after-free bug. The issue was reported by syzbot through a KASAN slab-use-after-free detection. The fix involved adding Read-Copy-Update (RCU) protection to synchronize access and prevent the race. This vulnerability affects kernel stability and security by enabling potential memory corruption.
Potential Impact
The vulnerability allows a race condition that leads to a use-after-free in kernel timer management within the mptcp subsystem. This can cause kernel memory corruption, which may result in system crashes (denial of service) or potentially privilege escalation if exploited. The severity is critical due to the kernel-level impact and the possibility of complete system compromise.
Mitigation Recommendations
A fix has been implemented in the Linux kernel by adding RCU protection to the affected function to prevent the race condition. Users and administrators should update their Linux kernel to a version that includes this fix. Since no specific patched versions are provided, check the official Linux kernel advisories or vendor updates for the patch. Patch status is not yet confirmed in this data — verify with the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call… (CVE-2025-40257)
Description
A critical race condition vulnerability in the Linux kernel's multipath TCP (mptcp) implementation was resolved. The function mptcp_pm_del_add_timer() could call sk_stop_timer_sync() on a timer entry that might have already been freed by another thread, leading to a use-after-free condition. This issue was detected by syzbot and fixed by adding RCU protection to prevent concurrent access to freed memory. The vulnerability could result in kernel memory corruption and potentially allow an attacker to cause denial of service or escalate privileges.
CVSS v3.1
Score 9.8critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-40257 addresses a race condition in the Linux kernel's multipath TCP (mptcp) code, specifically in the mptcp_pm_del_add_timer() function. The function could invoke sk_stop_timer_sync() on a timer entry that another thread might have already freed, causing a use-after-free bug. The issue was reported by syzbot through a KASAN slab-use-after-free detection. The fix involved adding Read-Copy-Update (RCU) protection to synchronize access and prevent the race. This vulnerability affects kernel stability and security by enabling potential memory corruption.
Potential Impact
The vulnerability allows a race condition that leads to a use-after-free in kernel timer management within the mptcp subsystem. This can cause kernel memory corruption, which may result in system crashes (denial of service) or potentially privilege escalation if exploited. The severity is critical due to the kernel-level impact and the possibility of complete system compromise.
Mitigation Recommendations
A fix has been implemented in the Linux kernel by adding RCU protection to the affected function to prevent the race condition. Users and administrators should update their Linux kernel to a version that includes this fix. Since no specific patched versions are provided, check the official Linux kernel advisories or vendor updates for the patch. Patch status is not yet confirmed in this data — verify with the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-q4wq-g3wm-gmfc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40257"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a6b72d59c2644c7f847992f
Added to database: 07/30/2026, 15:50:45 UTC
Last enriched: 07/30/2026, 17:37:26 UTC
Last updated: 09/10/2026, 19:38:47 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.