CVE-2025-40248

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

vsock: Ignore signal/timeout on connect() if already established

During connect(), acting on a signal/timeout by disconnecting an already

established socket leads to several issues:

1. connect() invoking vsock_transport_cancel_pkt() ->

virtio_transport_purge_skbs() may race with sendmsg() invoking

virtio_transport_get_credit(). This results in a permanently elevated

`vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.

2. connect() resetting a connected socket's state may race with socket

being placed in a sockmap. A disconnected socket remaining in a sockmap

breaks sockmap's assumptions. And gives rise to WARNs.

3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a

transport change/drop after TCP_ESTABLISHED. Which poses a problem for

any simultaneous sendmsg() or connect() and may result in a

use-after-free/null-ptr-deref.

Do not disconnect socket on si

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References