{"api_version":"1","generated_at":"2026-08-02T21:58:22+00:00","cve":"CVE-2025-40186","urls":{"html":"https://cve.report/CVE-2025-40186","api":"https://cve.report/api/cve/CVE-2025-40186.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-40186","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-40186"},"summary":{"title":"tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().\n\nsyzbot reported the splat below in tcp_conn_request(). [0]\n\nIf a listener is close()d while a TFO socket is being processed in\ntcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk\nand calls inet_child_forget(), which calls tcp_disconnect() for the\nTFO socket.\n\nAfter the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),\nwhere reqsk_put() is called due to !reqsk->sk.\n\nThen, reqsk_fastopen_remove() in tcp_conn_request() decrements the\nlast req->rsk_refcnt and frees reqsk, and __reqsk_free() at the\ndrop_and_free label causes the refcount underflow for the listener\nand double-free of the reqsk.\n\nLet's remove reqsk_fastopen_remove() in tcp_conn_request().\n\nNote that other callers make sure tp->fastopen_rsk is not NULL.\n\n[0]:\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)\nModules linked in:\nCPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:refcount_warn_saturate (lib/refcount.c:28)\nCode: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6\nRSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246\nRAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900\nRDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280\nRBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280\nR10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100\nR13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8\nFS:  00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0\nCall Trace:\n <IRQ>\n tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)\n tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)\n tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)\n tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)\n ip6_input (net/ipv6/ip6_input.c:500)\n ipv6_rcv (net/ipv6/ip6_input.c:311)\n __netif_receive_skb (net/core/dev.c:6104)\n process_backlog (net/core/dev.c:6456)\n __napi_poll (net/core/dev.c:7506)\n net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)\n handle_softirqs (kernel/softirq.c:579)\n do_softirq (kernel/softirq.c:480)\n </IRQ>","state":"PUBLISHED","assigner":"Linux","published_at":"2025-11-12 22:15:45","updated_at":"2026-07-30 06:24:16"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d","name":"https://git.kernel.org/stable/c/ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/64dc47a13aa3d9daf7cec29b44dca8e22a6aea15","name":"https://git.kernel.org/stable/c/64dc47a13aa3d9daf7cec29b44dca8e22a6aea15","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/643a94b0cf767325e953591c212be2eb826b9d7f","name":"https://git.kernel.org/stable/c/643a94b0cf767325e953591c212be2eb826b9d7f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e359b742eac1eac75cff4e38ee2e8cea492acd9b","name":"https://git.kernel.org/stable/c/e359b742eac1eac75cff4e38ee2e8cea492acd9b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2e7cbbbe3d61c63606994b7ff73c72537afe2e1c","name":"https://git.kernel.org/stable/c/2e7cbbbe3d61c63606994b7ff73c72537afe2e1c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/422c1c173c39bbbae1e0eaaf8aefe40b2596233b","name":"https://git.kernel.org/stable/c/422c1c173c39bbbae1e0eaaf8aefe40b2596233b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c11ace909e873118295e9eb22dc8c58b0b50eb32","name":"https://git.kernel.org/stable/c/c11ace909e873118295e9eb22dc8c58b0b50eb32","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/eb85ad5f23268d64b037bfb545cbcba3752f90c7","name":"https://git.kernel.org/stable/c/eb85ad5f23268d64b037bfb545cbcba3752f90c7","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40186","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40186","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7ec092a91ff351dcde89c23e795b73a328274db6 e359b742eac1eac75cff4e38ee2e8cea492acd9b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a4378dedd6e07e62f2fccb17d78c9665718763d0 ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 33a4fdf0b4a25f8ce65380c3b0136b407ca57609 eb85ad5f23268d64b037bfb545cbcba3752f90c7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 17d699727577814198d744d6afe54735c6b54c99 643a94b0cf767325e953591c212be2eb826b9d7f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dfd06131107e7b699ef1e2a24ed2f7d17c917753 422c1c173c39bbbae1e0eaaf8aefe40b2596233b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fa4749c065644af4db496b338452a69a3e5147d9 c11ace909e873118295e9eb22dc8c58b0b50eb32 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 64dc47a13aa3d9daf7cec29b44dca8e22a6aea15 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ae313d14b45eca7a6bb29cb9bf396d977e7d28fb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4.300 5.4.301 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.10.245 5.10.246 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.194 5.15.195 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.154 6.1.157 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.108 6.6.113 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.49 6.12.54 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.16.9 6.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.301 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.246 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.195 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.157 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.113 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.54 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17.4 6.17.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"40186","cve":"CVE-2025-40186","epss":"0.005330000","percentile":"0.420190000","score_date":"2026-07-31","updated_at":"2026-08-01 00:10:35"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/tcp_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e359b742eac1eac75cff4e38ee2e8cea492acd9b","status":"affected","version":"7ec092a91ff351dcde89c23e795b73a328274db6","versionType":"git"},{"lessThan":"ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d","status":"affected","version":"a4378dedd6e07e62f2fccb17d78c9665718763d0","versionType":"git"},{"lessThan":"eb85ad5f23268d64b037bfb545cbcba3752f90c7","status":"affected","version":"33a4fdf0b4a25f8ce65380c3b0136b407ca57609","versionType":"git"},{"lessThan":"643a94b0cf767325e953591c212be2eb826b9d7f","status":"affected","version":"17d699727577814198d744d6afe54735c6b54c99","versionType":"git"},{"lessThan":"422c1c173c39bbbae1e0eaaf8aefe40b2596233b","status":"affected","version":"dfd06131107e7b699ef1e2a24ed2f7d17c917753","versionType":"git"},{"lessThan":"c11ace909e873118295e9eb22dc8c58b0b50eb32","status":"affected","version":"fa4749c065644af4db496b338452a69a3e5147d9","versionType":"git"},{"lessThan":"64dc47a13aa3d9daf7cec29b44dca8e22a6aea15","status":"affected","version":"45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01","versionType":"git"},{"lessThan":"2e7cbbbe3d61c63606994b7ff73c72537afe2e1c","status":"affected","version":"45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01","versionType":"git"},{"status":"affected","version":"ae313d14b45eca7a6bb29cb9bf396d977e7d28fb","versionType":"git"},{"lessThan":"5.4.301","status":"affected","version":"5.4.300","versionType":"semver"},{"lessThan":"5.10.246","status":"affected","version":"5.10.245","versionType":"semver"},{"lessThan":"5.15.195","status":"affected","version":"5.15.194","versionType":"semver"},{"lessThan":"6.1.157","status":"affected","version":"6.1.154","versionType":"semver"},{"lessThan":"6.6.113","status":"affected","version":"6.6.108","versionType":"semver"},{"lessThan":"6.12.54","status":"affected","version":"6.12.49","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.9","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/tcp_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.301","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.246","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.195","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.157","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.113","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.54","versionType":"semver"},{"lessThanOrEqual":"6.17.*","status":"unaffected","version":"6.17.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.18","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.301","versionStartIncluding":"5.4.300","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.246","versionStartIncluding":"5.10.245","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.195","versionStartIncluding":"5.15.194","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.157","versionStartIncluding":"6.1.154","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.113","versionStartIncluding":"6.6.108","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.54","versionStartIncluding":"6.12.49","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17.4","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16.9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().\n\nsyzbot reported the splat below in tcp_conn_request(). [0]\n\nIf a listener is close()d while a TFO socket is being processed in\ntcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk\nand calls inet_child_forget(), which calls tcp_disconnect() for the\nTFO socket.\n\nAfter the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),\nwhere reqsk_put() is called due to !reqsk->sk.\n\nThen, reqsk_fastopen_remove() in tcp_conn_request() decrements the\nlast req->rsk_refcnt and frees reqsk, and __reqsk_free() at the\ndrop_and_free label causes the refcount underflow for the listener\nand double-free of the reqsk.\n\nLet's remove reqsk_fastopen_remove() in tcp_conn_request().\n\nNote that other callers make sure tp->fastopen_rsk is not NULL.\n\n[0]:\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)\nModules linked in:\nCPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:refcount_warn_saturate (lib/refcount.c:28)\nCode: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6\nRSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246\nRAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900\nRDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280\nRBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280\nR10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100\nR13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8\nFS:  00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0\nCall Trace:\n <IRQ>\n tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)\n tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)\n tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)\n tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)\n ip6_input (net/ipv6/ip6_input.c:500)\n ipv6_rcv (net/ipv6/ip6_input.c:311)\n __netif_receive_skb (net/core/dev.c:6104)\n process_backlog (net/core/dev.c:6456)\n __napi_poll (net/core/dev.c:7506)\n net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)\n handle_softirqs (kernel/softirq.c:579)\n do_softirq (kernel/softirq.c:480)\n </IRQ>"}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-07-30T06:01:16.215Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e359b742eac1eac75cff4e38ee2e8cea492acd9b"},{"url":"https://git.kernel.org/stable/c/ff6a8883f96a5bc74241ce5b3d431a6dcfa2124d"},{"url":"https://git.kernel.org/stable/c/eb85ad5f23268d64b037bfb545cbcba3752f90c7"},{"url":"https://git.kernel.org/stable/c/643a94b0cf767325e953591c212be2eb826b9d7f"},{"url":"https://git.kernel.org/stable/c/422c1c173c39bbbae1e0eaaf8aefe40b2596233b"},{"url":"https://git.kernel.org/stable/c/c11ace909e873118295e9eb22dc8c58b0b50eb32"},{"url":"https://git.kernel.org/stable/c/64dc47a13aa3d9daf7cec29b44dca8e22a6aea15"},{"url":"https://git.kernel.org/stable/c/2e7cbbbe3d61c63606994b7ff73c72537afe2e1c"}],"title":"tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-40186","datePublished":"2025-11-12T21:56:29.033Z","dateReserved":"2025-04-16T07:20:57.177Z","dateUpdated":"2026-07-30T06:01:16.215Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-11-12 22:15:45","lastModifiedDate":"2026-07-30 06:24:16","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"40186","Ordinal":"1","Title":"tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().","CVE":"CVE-2025-40186","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"40186","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().\n\nsyzbot reported the splat below in tcp_conn_request(). [0]\n\nIf a listener is close()d while a TFO socket is being processed in\ntcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk\nand calls inet_child_forget(), which calls tcp_disconnect() for the\nTFO socket.\n\nAfter the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),\nwhere reqsk_put() is called due to !reqsk->sk.\n\nThen, reqsk_fastopen_remove() in tcp_conn_request() decrements the\nlast req->rsk_refcnt and frees reqsk, and __reqsk_free() at the\ndrop_and_free label causes the refcount underflow for the listener\nand double-free of the reqsk.\n\nLet's remove reqsk_fastopen_remove() in tcp_conn_request().\n\nNote that other callers make sure tp->fastopen_rsk is not NULL.\n\n[0]:\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)\nModules linked in:\nCPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:refcount_warn_saturate (lib/refcount.c:28)\nCode: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6\nRSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246\nRAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900\nRDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280\nRBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280\nR10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100\nR13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8\nFS:  00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0\nCall Trace:\n <IRQ>\n tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)\n tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)\n tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)\n tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)\n ip6_input (net/ipv6/ip6_input.c:500)\n ipv6_rcv (net/ipv6/ip6_input.c:311)\n __netif_receive_skb (net/core/dev.c:6104)\n process_backlog (net/core/dev.c:6456)\n __napi_poll (net/core/dev.c:7506)\n net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)\n handle_softirqs (kernel/softirq.c:579)\n do_softirq (kernel/softirq.c:480)\n </IRQ>","Type":"Description","Title":"tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request()."}]}}}