CVE-2025-40280

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: Fix use-after-free in tipc_mon_reinit_self().

syzbot reported use-after-free of tipc_net(net)->monitors[]

in tipc_mon_reinit_self(). [0]

The array is protected by RTNL, but tipc_mon_reinit_self()

iterates over it without RTNL.

tipc_mon_reinit_self() is called from tipc_net_finalize(),

which is always under RTNL except for tipc_net_finalize_work().

Let's hold RTNL in tipc_net_finalize_work().

[0]:

BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]

BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162

Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989

CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025

Workqueue: events tipc_net_finalize_work

Call Trace:

<TASK>

dump_stack_l

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References