PT-2025-49020 · Linux+3 · Linux Kernel+3
Published
2025-11-11
·
Updated
2026-03-25
·
CVE-2025-40214
CVSS v2.0
6.0
Medium
| Vector | AV:L/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel’s AF UNIX garbage collection mechanism could incorrectly collect a receive queue of an active socket. This occurs due to a failure to initialize the
scc index in the unix add edge() function. The issue involves a cyclic reference with multiple sockets, leading to a misjudgment by unix vertex dead() that sockets are in the same strongly connected component (SCC) and are dead when they are still in use. The root cause is that unix add edge() does not initialize scc index, potentially leading to incorrect SCC assignments and premature garbage collection of active sockets. The vulnerability was reported by Quang Le, who provided a reproduction scenario involving three stages of socket creation, closing, and acceptance.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Ubuntu