CVE-2025-40186

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().

syzbot reported the splat below in tcp_conn_request(). [0]

If a listener is close()d while a TFO socket is being processed in

tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk

and calls inet_child_forget(), which calls tcp_disconnect() for the

TFO socket.

After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),

where reqsk_put() is called due to !reqsk->sk.

Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the

last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the

drop_and_free label causes the refcount underflow for the listener

and double-free of the reqsk.

Let's remove reqsk_fastopen_remove() in tcp_conn_request().

Note that other callers make sure tp->fastopen_rsk is not NULL.

[0]:

refcount_t: underflow; use-after-free.

WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References