In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During… (CVE-2025-40248)
In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling. 2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs. 3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref. Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg(). [1]: https://lore.kernel.org/netdev/[email protected]/ [2]: https://lore.kernel.org/netdev/[email protected]/ [3]: https://lore.kernel.org/netdev/[email protected]/
AI Analysis
Technical Summary
This vulnerability involves the Linux kernel's vsock component, which may lead to memory corruption as identified by CVE-2025-40248. Red Hat has issued a kpatch live patch module (kpatch-patch-5_14_0-611_9_1) for Red Hat Enterprise Linux 9 kernel version 5.14.0-611.9.1.el9_7 to remediate this issue. The patch modifies the running kernel code via the kpatch utility. The advisory rates the update as important and requires a system reboot for the patch to be applied. No CVSS score is provided in the advisory, and no known exploits in the wild have been reported.
Potential Impact
The vulnerability may lead to memory corruption in the Linux kernel vsock implementation, which could potentially affect system stability or security. The exact impact details and exploitability are not provided beyond this description. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
An official security update is available from Red Hat as a kpatch live patch module for kernel-5.14.0-611.9.1.el9_7. Applying this update and rebooting the system is required to remediate the vulnerability. Refer to Red Hat's official guidance at https://access.redhat.com/articles/11258 for update instructions. Systems running the affected kernel version should prioritize applying this patch.
In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During… (CVE-2025-40248)
Description
In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling. 2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs. 3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref. Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg(). [1]: https://lore.kernel.org/netdev/[email protected]/ [2]: https://lore.kernel.org/netdev/[email protected]/ [3]: https://lore.kernel.org/netdev/[email protected]/
CVSS v3.1
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves the Linux kernel's vsock component, which may lead to memory corruption as identified by CVE-2025-40248. Red Hat has issued a kpatch live patch module (kpatch-patch-5_14_0-611_9_1) for Red Hat Enterprise Linux 9 kernel version 5.14.0-611.9.1.el9_7 to remediate this issue. The patch modifies the running kernel code via the kpatch utility. The advisory rates the update as important and requires a system reboot for the patch to be applied. No CVSS score is provided in the advisory, and no known exploits in the wild have been reported.
Potential Impact
The vulnerability may lead to memory corruption in the Linux kernel vsock implementation, which could potentially affect system stability or security. The exact impact details and exploitability are not provided beyond this description. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
An official security update is available from Red Hat as a kpatch live patch module for kernel-5.14.0-611.9.1.el9_7. Applying this update and rebooting the system is required to remediate the vulnerability. Refer to Red Hat's official guidance at https://access.redhat.com/articles/11258 for update instructions. Systems running the affected kernel version should prioritize applying this patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:3987
- Cve Count
- 1
- Cvss Version
- 3.1
Threat ID: 6a4049da27e9c7971982f53a
Added to database: 06/27/2026, 22:08:26 UTC
Last enriched: 06/27/2026, 22:21:26 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.