FlawAtlas
Search the atlas
UBUNTU-CVE-2025-40186 High

UBUNTU-CVE-2025-40186

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>

Exploit probability Not scored
Published November 12, 2025
Required by Not available
Last source change August 17, 2026

02 / AFFECTED SOFTWARE

Affected packages

Ubuntu:22.04:LTS linux-starfive-6.5

11 explicit affected versions

Ubuntu:18.04:LTS linux-oem

50 explicit affected versions

Ubuntu:18.04:LTS linux-aws-5.0

6 explicit affected versions

Ubuntu:20.04:LTS linux-aws-5.11

12 explicit affected versions

Ubuntu:22.04:LTS linux-azure-5.19

7 explicit affected versions

Ubuntu:22.04:LTS linux-gcp-6.5

13 explicit affected versions

Ubuntu:20.04:LTS linux-oem-5.14

35 explicit affected versions

Ubuntu:22.04:LTS linux-oem-6.5

19 explicit affected versions

Ubuntu:20.04:LTS linux-raspi2

6 explicit affected versions

Ubuntu:24.04:LTS linux-riscv

24 explicit affected versions

Ubuntu:22.04:LTS linux-riscv-6.5

10 explicit affected versions

Ubuntu:24.04:LTS linux-oem-6.8

26 explicit affected versions

Ubuntu:20.04:LTS linux-gke-5.15

18 explicit affected versions

Ubuntu:20.04:LTS linux-aws-5.13

13 explicit affected versions

Ubuntu:20.04:LTS linux-aws-5.8

4 explicit affected versions

Ubuntu:16.04:LTS linux-hwe-edge

23 explicit affected versions

Ubuntu:24.04:LTS linux-raspi-realtime

1 explicit affected versions

Ubuntu:20.04:LTS linux-hwe-5.8

21 explicit affected versions

Ubuntu:20.04:LTS linux-hwe-5.13

16 explicit affected versions

Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2

10 explicit affected versions

Ubuntu:25.10 linux

12 explicit affected versions

Ubuntu:24.04:LTS linux-hwe-6.11

8 explicit affected versions

Ubuntu:18.04:LTS linux-oracle-5.0

7 explicit affected versions

Ubuntu:20.04:LTS linux-riscv

12 explicit affected versions

Ubuntu:24.04:LTS linux-azure-6.11

7 explicit affected versions

Ubuntu:20.04:LTS linux-gcp-5.11

12 explicit affected versions

Ubuntu:22.04:LTS linux-azure-6.5

14 explicit affected versions

Ubuntu:25.10 linux-azure-fde

10 explicit affected versions

Ubuntu:22.04:LTS linux-intel-iot-realtime

1 explicit affected versions

Ubuntu:20.04:LTS linux-intel-5.13

7 explicit affected versions

Ubuntu:20.04:LTS linux-oem-5.13

12 explicit affected versions

Ubuntu:24.04:LTS linux-oracle-6.17

1 explicit affected versions

Ubuntu:20.04:LTS linux-oracle-5.11

12 explicit affected versions

Ubuntu:25.10 linux-gcp

9 explicit affected versions

Ubuntu:18.04:LTS linux-hwe-edge

10 explicit affected versions

Ubuntu:18.04:LTS linux-gke-5.4

37 explicit affected versions

Ubuntu:24.04:LTS linux-gcp-6.17

1 explicit affected versions

Ubuntu:22.04:LTS linux-oracle-6.5

13 explicit affected versions

Ubuntu:22.04:LTS linux-azure-fde-6.2

10 explicit affected versions

Ubuntu:20.04:LTS linux-oem-5.10

26 explicit affected versions

Ubuntu:20.04:LTS linux-gcp-5.13

13 explicit affected versions

Ubuntu:20.04:LTS linux-oem-5.6

29 explicit affected versions

Ubuntu:18.04:LTS linux-gcp-5.3

13 explicit affected versions

Ubuntu:18.04:LTS linux-gke-4.15

33 explicit affected versions

Ubuntu:22.04:LTS linux-riscv

23 explicit affected versions

Ubuntu:18.04:LTS linux-aws-5.3

10 explicit affected versions

Ubuntu:Nvidia-BlueField:24.04:LTS linux-bluefield

11 explicit affected versions

Ubuntu:20.04:LTS linux-hwe-5.11

12 explicit affected versions

Ubuntu:Pro:Realtime:24.04:LTS linux-realtime-6.17

1 explicit affected versions

Ubuntu:20.04:LTS linux-azure-5.8

7 explicit affected versions

Ubuntu:22.04:LTS linux-gcp-6.2

12 explicit affected versions

Ubuntu:25.10 linux-azure

8 explicit affected versions

Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19

10 explicit affected versions

Ubuntu:22.04:LTS linux-oem-5.17

26 explicit affected versions

Ubuntu:24.04:LTS linux-aws-6.17

1 explicit affected versions

Ubuntu:22.04:LTS linux-azure-6.2

13 explicit affected versions

Ubuntu:22.04:LTS linux-oem-6.0

16 explicit affected versions

Ubuntu:22.04:LTS linux-azure-fde-5.19

3 explicit affected versions

Ubuntu:24.04:LTS linux-gcp-6.11

7 explicit affected versions

Ubuntu:25.10 linux-riscv

7 explicit affected versions

Ubuntu:20.04:LTS linux-gke

51 explicit affected versions

Ubuntu:25.10 linux-oracle

8 explicit affected versions

Ubuntu:24.04:LTS linux-oem-6.11

18 explicit affected versions

Ubuntu:20.04:LTS linux-azure-5.13

12 explicit affected versions

Ubuntu:24.04:LTS linux-nvidia-6.17

1 explicit affected versions

Ubuntu:22.04:LTS linux-oem-6.1

27 explicit affected versions

Ubuntu:22.04:LTS linux-gcp-5.19

8 explicit affected versions

Ubuntu:20.04:LTS linux-oracle-5.8

5 explicit affected versions

Ubuntu:22.04:LTS linux-riscv-5.19

8 explicit affected versions

Ubuntu:22.04:LTS linux-hwe-6.2

10 explicit affected versions

Ubuntu:24.04:LTS linux-lowlatency-hwe-6.11

7 explicit affected versions

Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5

13 explicit affected versions

Ubuntu:20.04:LTS linux-azure-5.11

13 explicit affected versions

Ubuntu:22.04:LTS linux-starfive-5.19

7 explicit affected versions

Ubuntu:20.04:LTS linux-riscv-5.8

10 explicit affected versions

Ubuntu:20.04:LTS linux-oracle-5.13

12 explicit affected versions

Ubuntu:18.04:LTS linux-azure

44 explicit affected versions

Ubuntu:18.04:LTS linux-azure-5.3

16 explicit affected versions

Ubuntu:22.04:LTS linux-starfive-6.2

3 explicit affected versions

Ubuntu:20.04:LTS linux-riscv-5.11

13 explicit affected versions

Ubuntu:20.04:LTS linux-azure-fde

26 explicit affected versions

Ubuntu:20.04:LTS linux-gkeop-5.15

45 explicit affected versions

Ubuntu:18.04:LTS linux-gkeop-5.4

37 explicit affected versions

Ubuntu:22.04:LTS linux-aws-6.5

14 explicit affected versions

Ubuntu:18.04:LTS linux-gcp

38 explicit affected versions

Ubuntu:18.04:LTS linux-oracle-5.3

9 explicit affected versions

Ubuntu:25.10 linux-aws

9 explicit affected versions

Ubuntu:22.04:LTS linux-hwe-5.19

11 explicit affected versions

Ubuntu:25.10 linux-raspi

6 explicit affected versions

Ubuntu:22.04:LTS linux-nvidia-6.2

7 explicit affected versions

Ubuntu:20.04:LTS linux-gcp-5.8

4 explicit affected versions

Ubuntu:24.04:LTS linux-realtime

1 explicit affected versions

Ubuntu:22.04:LTS linux-hwe-6.5

13 explicit affected versions

Ubuntu:18.04:LTS linux-hwe

43 explicit affected versions

Ubuntu:24.04:LTS linux-oem-6.17

6 explicit affected versions

Ubuntu:22.04:LTS linux-aws-5.19

10 explicit affected versions

Ubuntu:22.04:LTS linux-allwinner-5.19

8 explicit affected versions

Ubuntu:22.04:LTS linux-aws-6.2

14 explicit affected versions

Ubuntu:18.04:LTS linux-azure-edge

4 explicit affected versions

Ubuntu:20.04:LTS linux-gkeop

78 explicit affected versions

Ubuntu:25.10 linux-realtime

6 explicit affected versions

Ubuntu:22.04:LTS linux-nvidia-6.5

11 explicit affected versions

Ubuntu:22.04:LTS linux-realtime

1 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities UBUNTU-CVE-2025-40186

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>

View original source

05 / REFERENCES

Further evidence