PT-2025-49078 · Linux+4 · Linux Kernel+4
Published
2025-04-12
·
Updated
2026-05-26
·
CVE-2025-40248
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel’s vsock implementation. Specifically, the issue arises when handling signals or timeouts during a
connect() operation on an already established socket. Acting on a signal or timeout by disconnecting an established socket can lead to race conditions with other operations, such as sendmsg(), potentially causing issues like permanently elevated vvs->bytes unsent, broken sockmap assumptions due to disconnected sockets remaining in the sockmap, and potential use-after-free or null-pointer dereferences if a transport change or drop occurs after TCP ESTABLISHED. The resolution involves preventing disconnection of the socket on signal or timeout, maintaining the existing logic for unconnected sockets. The connect() function may invoke vsock transport cancel pkt() which then calls virtio transport purge skbs(), potentially racing with sendmsg() invoking virtio transport get credit().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Rocky Linux
Ubuntu