CVE-2025-40133 addresses a use-after-free vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation. The vulnerable function mptcp_active_enable() calls subflow_finish_connect(), which invokes icsk->icsk_af_ops->sk_rx_dst_set(). This call is not always protected by Read-Copy-Update (RCU), causing unsafe access to sk_dst_get(sk)->dev and potentially triggering a use-after-free condition. The patch replaces sk_dst_get() with __sk_dst_get() and uses dst_dev_rcu() to ensure safe access under RCU, mitigating the UAF risk.

Successful exploitation could lead to use-after-free memory corruption in the Linux kernel's MPTCP code, potentially allowing an attacker to cause denial of service or execute arbitrary code with kernel privileges. The CVSS vector indicates network attack vector, high complexity, no privileges or user interaction required, with high confidentiality, integrity, and availability impact.

A fix has been implemented in the Linux kernel by modifying mptcp_active_enable() to use __sk_dst_get() and dst_dev_rcu() for safe reference access. Users should apply the official kernel updates containing this patch once available. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.