CVE-2025-40248
NoneCVSS
—
EPSS
0.2%
Published
Dec 4, 2025
CISA due date
—
The record
In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling. 2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs. 3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref. Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg(). [1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/ [2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/ [3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | bpftool | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-abi-stablelists | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-core | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-cross-headers | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-debug | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-debug-core | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-debug-devel | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules-extra | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-devel | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-doc | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-headers | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-modules | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-modules-extra | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-rt | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-rt-core | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-rt-debug | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-core | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-devel | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-rt-devel | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-rt-modules | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-rt-modules-extra | 0 | 4.18.0-553.97.1.rt7.438.el8_10 |
| AlmaLinux:8 | kernel-tools | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-tools-libs | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-tools-libs-devel | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-core | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-devel | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-modules | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-modules-extra | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | perf | 0 | 4.18.0-553.97.1.el8_10 |
| AlmaLinux:8 | python3-perf | 0 | 4.18.0-553.97.1.el8_10 |
| Linux | Kernel | 3.9.0 | 5.4.302 |
| Mageia:9 | kernel | 0 | 6.6.120-1.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.120-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.1.14-14.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-88.mga9 |
| openSUSE:Leap 16.0 | dtb-aarch64 | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-64kb | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-azure | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-default | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-default-base | 0 | 6.12.0-160000.9.1.160000.2.6 |
| openSUSE:Leap 16.0 | kernel-docs | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-kvmsmall | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-obs-build | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-obs-qa | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-rt | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-source | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-syms | 0 | 6.12.0-160000.9.1 |
| openSUSE:Leap 16.0 | kernel-zfcpdump | 0 | 6.12.0-160000.9.1 |
Related vulnerabilities
- CVE-2025-68301 In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix… Also affects bpftool
- CVE-2025-68285 In the Linux kernel, the following vulnerability has been resolved: libceph: fix… Also affects bpftool
- CVE-2025-40277 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate… Also affects bpftool
- CVE-2025-40240 In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL… Also affects bpftool
- CVE-2025-40154 In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel… Also affects bpftool
- CVE-2025-40096 In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix… Also affects bpftool
- CVE-2025-38352 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix… Also affects bpftool
- CVE-2024-57807 In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas… Also affects bpftool