Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-40258

11
FAUCET Score

CVE-2025-40258 is a race condition vulnerability in the Linux kernel's MPTCP (Multipath TCP) implementation, specifically within the mptcp_schedule_work() function. This flaw can lead to a use-after-free condition, as reported by syzbot, due to incorrect handling of socket reference counts when scheduling work. The vulnerability affects the Linux kernel and could potentially lead to system instability or denial of service. The severity of this vulnerability is moderate, with a FAUCET Risk Score of 7/100. It involves a race condition, suggesting a higher attack complexity, and its impact could range from system crashes to potential denial of service. The vulnerability does not have an assigned CVSS score, and no specific attack vector is detailed beyond the internal kernel function. Currently, there is no evidence of active exploitation, and no exploit code is publicly available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public attention at this time.

Impacted Technologies

VendorProductVersion(s)CPE
LinuxLinux
5.7CNA affecteddefault affected
LinuxLinux
>= 3b1d6210a9577369103330b0d802b0bf74b65e7f, < 035bca3f017ee9dea3a5a756e77a6f7138cc6eea, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f, < 3fc7723ed01d1130d4bf7063c50e0af60ecccbb4, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f, < 8f9ba1a99a89feef9b5867c15a0141a97e893309, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f, < 99908e2d601236842d705d5fd04fb349577316f5, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f, < ac28dfddedf6f209190950fc71bcff65ec4ab47b, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f, < db4f7968a75250ca6c4ed70d0a78beabb2dcee18, >= 3b1d6210a9577369103330b0d802b0bf74b65e7f, < f865e6595acf33083168db76921e66ace8bf0e5bCNA affecteddefault unaffected

CVSS Data

CVSS data has not been published for this CVE.

Exploit Intelligence

EPSS Score
0.18%
Probability of exploitation in next 30 days
EPSS Percentile
7.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15

Social Chatter

Media Mentions

Remediation

Patch Available

Vendor Patches (92)

microsoftpatch availablevia msrc
Product: 20725-17084Fixed in: 6.6.119.3-1
microsoftpatch availablevia msrc
Product: azl3 kernel 6.6.117.1-1 on Azure Linux 3.0Fixed in: 6.6.119.3-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceFixed in: kernel-0:4.18.0-477.128.1.el8_8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsFixed in: kernel-0:4.18.0-477.128.1.el8_8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel-0:5.14.0-611.26.1.el9_7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: kernel-0:5.14.0-70.163.1.el9_0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: kernel-rt-0:5.14.0-70.163.1.rt21.235.el9_0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: kernel-0:6.12.0-124.31.1.el10_1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: kernel-0:5.14.0-284.156.1.el9_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: kernel-rt-0:5.14.0-284.156.1.rt14.441.el9_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: kernel-0:5.14.0-427.108.1.el9_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.6 Extended Update SupportFixed in: kernel-0:5.14.0-570.81.1.el9_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 10.0 Extended Update SupportFixed in: kernel-0:6.12.0-55.58.1.el10_0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-rt-0:4.18.0-553.100.1.rt7.441.el8_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-0:4.18.0-553.100.1.el8_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: kernel-0:4.18.0-372.179.1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: kernel-0:4.18.0-372.179.1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: kernel-0:4.18.0-372.179.1.el8_6
View patch
ubuntupatch availablevia ubuntu_usn
Product: linux-kvm (jammy)Fixed in: 5.15.0-1095.100
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency (jammy)Fixed in: 5.15.0-173.183
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia (jammy)Fixed in: 5.15.0-1098.99
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra (jammy)Fixed in: 5.15.0-1055.55
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (jammy)Fixed in: 5.15.0-1100.106
ubuntupatch availablevia ubuntu_usn
Product: linux-xilinx-zynqmp (jammy)Fixed in: 5.15.0-1067.71
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-6.8 (jammy)Fixed in: 6.8.0-1052.55~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-6.8 (jammy)Fixed in: 6.8.0-106.106~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm-6.8 (jammy)Fixed in: 6.8.0-1049.49~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency-hwe-6.8 (jammy)Fixed in: 6.8.0-106.106.1~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-6.8 (jammy)Fixed in: 6.8.0-1047.48~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux (noble)Fixed in: 6.8.0-106.106
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (noble)Fixed in: 6.8.0-1050.53
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (noble)Fixed in: 6.8.0-1052.55
ubuntupatch availablevia ubuntu_usn
Product: linux-gke (noble)Fixed in: 6.8.0-1048.53
ubuntupatch availablevia ubuntu_usn
Product: linux-gkeop (noble)Fixed in: 6.8.0-1035.38
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm (noble)Fixed in: 6.8.0-1049.49
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency (noble)Fixed in: 6.8.0-106.106.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (noble)Fixed in: 6.8.0-1047.48
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-6.17 (noble)Fixed in: 6.17.0-1009.9~24.04.2
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-6.17 (noble)Fixed in: 6.17.0-19.19~24.04.2
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-6.17 (noble)Fixed in: 6.17.0-1009.9~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux (questing)Fixed in: 6.17.0-19.19
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (questing)Fixed in: 6.17.0-1009.9
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (questing)Fixed in: 6.17.0-1009.9
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (questing)Fixed in: 6.17.0-1009.9
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (jammy)Fixed in: 5.15.0-1102.111
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-5.15 (focal)Fixed in: 5.15.0-1103.110~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-5.15 (focal)Fixed in: 5.15.0-1103.112~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-5.15 (focal)Fixed in: 5.15.0-173.183~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iotg-5.15 (focal)Fixed in: 5.15.0-1098.104~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency-hwe-5.15 (focal)Fixed in: 5.15.0-173.183~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-5.15 (focal)Fixed in: 5.15.0-1100.106~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gke (jammy)Fixed in: 5.15.0-1099.105
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-6.17 (noble)Fixed in: 6.17.0-1009.9~24.04.3
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (questing)Fixed in: 6.17.0-1008.9
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime-6.8 (jammy)Fixed in: 6.8.1-1045.46~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (noble)Fixed in: 6.8.1-1045.46
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime-6.17 (noble)Fixed in: 6.17.0-1008.9~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-6.8 (jammy)Fixed in: 6.8.0-1050.53~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra-igx (jammy)Fixed in: 5.15.0-1044.44
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iot-realtime (jammy)Fixed in: 5.15.0-1094.96
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-6.8 (jammy)Fixed in: 6.8.0-1051.57~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (noble)Fixed in: 6.8.0-1051.57
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-6.17 (noble)Fixed in: 6.17.0-1010.10~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-5.15 (focal)Fixed in: 5.15.0-1110.119~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-xilinx (noble)Fixed in: 6.8.0-1029.30
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (noble)Fixed in: 6.8.0-1050.54
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi-realtime (noble)Fixed in: 6.8.0-2040.41
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (jammy)Fixed in: 5.15.0-1097.100
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (questing)Fixed in: 6.17.0-1010.10
ubuntupatch availablevia ubuntu_usn
Product: linux-oem-6.17 (noble)Fixed in: 6.17.0-1017.17
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-fips (noble)Fixed in: 6.8.0-1052.58+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-fips (jammy)Fixed in: 5.15.0-1109.118+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (jammy)Fixed in: 5.15.0-1109.118
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (questing)Fixed in: 6.17.0-1010.10
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-fips (jammy)Fixed in: 5.15.0-1103.110+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-fips (jammy)Fixed in: 5.15.0-173.183+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-fips (jammy)Fixed in: 5.15.0-1103.112+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-fips (noble)Fixed in: 6.8.0-1050.53+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-fips (noble)Fixed in: 6.8.0-106.106+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-fips (noble)Fixed in: 6.8.0-1052.55+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-6.8 (jammy)Fixed in: 6.8.0-1049.52~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia (noble)Fixed in: 6.8.0-1049.52
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-lowlatency (noble)Fixed in: 6.8.0-1049.52.1
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm-5.15 (focal)Fixed in: 5.15.0-1097.100~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra-5.15 (focal)Fixed in: 5.15.0-1055.55~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux (jammy)Fixed in: 5.15.0-173.183
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (jammy)Fixed in: 5.15.0-1103.110
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (jammy)Fixed in: 5.15.0-1103.112
ubuntupatch availablevia ubuntu_usn
Product: linux-gkeop (jammy)Fixed in: 5.15.0-1086.94
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm (jammy)Fixed in: 5.15.0-1097.100
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iotg (jammy)Fixed in: 5.15.0-1098.104
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel-rt

Vendor Advisories (28)

ubuntuUSN-8261-1

Linux kernel (Xilinx) vulnerabilities

May 7, 2026
ubuntuUSN-8243-1

Linux kernel (Azure) vulnerabilities

May 7, 2026
ubuntuUSN-8163-2

Linux kernel (Azure) vulnerabilities

Apr 13, 2026
ubuntuUSN-8165-1

Linux kernel (Azure FIPS) vulnerabilities

Apr 9, 2026
ubuntuUSN-8163-1

Linux kernel (Azure FIPS) vulnerabilities

Apr 9, 2026
ubuntuUSN-8152-1

Linux kernel (OEM) vulnerabilities

Apr 6, 2026
ubuntuUSN-8095-5

Linux kernel (Raspberry Pi) vulnerabilities

Apr 1, 2026
ubuntuUSN-8141-1

Linux kernel (Raspberry Pi) vulnerabilities

Apr 1, 2026
ubuntuUSN-8094-5

Linux kernel (Raspberry Pi) vulnerabilities

Apr 1, 2026
ubuntuUSN-8126-1

Linux kernel (Azure) vulnerabilities

Mar 25, 2026
ubuntuUSN-8125-1

Linux kernel (Azure) vulnerabilities

Mar 25, 2026
ubuntuUSN-8094-4

Linux kernel (Azure) vulnerabilities

Mar 25, 2026
ubuntuUSN-8094-3

Linux kernel (Real-time) vulnerabilities

Mar 23, 2026
ubuntuUSN-8095-4

Linux kernel (AWS) vulnerabilities

Mar 23, 2026
ubuntuUSN-8096-5

Linux kernel (NVIDIA Tegra IGX) vulnerabilities

Mar 23, 2026
ubuntuUSN-8116-1

Linux kernel (Intel IoTG Real-time) vulnerabilities

Mar 23, 2026
ubuntuUSN-8096-4

Linux kernel (Real-time) vulnerabilities

Mar 17, 2026
ubuntuUSN-8096-3

Linux kernel vulnerabilities

Mar 17, 2026
ubuntuUSN-8094-2

Linux kernel vulnerabilities

Mar 17, 2026
ubuntuUSN-8095-3

Linux kernel (Real-time) vulnerabilities

Mar 17, 2026
ubuntuUSN-8096-2

Linux kernel (FIPS) vulnerabilities

Mar 16, 2026
ubuntuUSN-8095-2

Linux kernel (FIPS) vulnerabilities

Mar 16, 2026
ubuntuUSN-8100-1

Linux kernel (NVIDIA) vulnerabilities

Mar 16, 2026
ubuntuUSN-8096-1

Linux kernel vulnerabilities

Mar 16, 2026
ubuntuUSN-8095-1

Linux kernel vulnerabilities

Mar 16, 2026
ubuntuUSN-8094-1

Linux kernel vulnerabilities

Mar 16, 2026
microsoft2025-Dec/CVE-2025-40258Important

mptcp: fix race condition in mptcp_schedule_work()

Dec 9, 2025
redhatCVE-2025-40258Moderate

kernel: mptcp: fix race condition in mptcp_schedule_work()

Dec 4, 2025

References

cert-portal.siemens.com / productcert/html/ssa-253495.html
git.kernel.org / stable/c/035bca3f017ee9dea3a5a756e77a6f7138cc6eea
git.kernel.org / stable/c/3fc7723ed01d1130d4bf7063c50e0af60ecccbb4
git.kernel.org / stable/c/8f9ba1a99a89feef9b5867c15a0141a97e893309
git.kernel.org / stable/c/99908e2d601236842d705d5fd04fb349577316f5
git.kernel.org / stable/c/ac28dfddedf6f209190950fc71bcff65ec4ab47b
git.kernel.org / stable/c/db4f7968a75250ca6c4ed70d0a78beabb2dcee18
git.kernel.org / stable/c/f865e6595acf33083168db76921e66ace8bf0e5b