CVE-2025-40133: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
In the Linux kernel, the following vulnerability has been resolved:
mptcp: Use skdstget() and dstdevrcu() in mptcpactiveenable().
mptcpactiveenable() is called from subflowfinishconnect(), which is icsk->icskafops->skrxdstset() and it's not always under RCU.
Using skdstget(sk)->dev could trigger UAF.
Let's use skdstget() and dstdevrcu().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40133?
CVE-2025-40133 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-40133?
To fix CVE-2025-40133, you should update the Linux kernel to the latest version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-40133?
CVE-2025-40133 affects various versions of the Linux kernel that utilize mptcp functionality.
What components are impacted by CVE-2025-40133?
CVE-2025-40133 impacts the mptcp subsystem in the Linux kernel, specifically during the active enable process.
What are the potential risks of CVE-2025-40133?
The potential risks of CVE-2025-40133 include security vulnerabilities that could lead to data corruption or denial of service.