CVE-2025-40257: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40257 is a race condition vulnerability in the Linux kernel's Multipath TCP (MPTCP) path management subsystem, specifically in the mptcp_pm_del_add_timer() function. The flaw allows a timer to be stopped via sk_stop_timer_sync() after the associated entry has already been freed, resulting in a use-after-free (UAF) condition. It was published on December 4, 2025, and affects the Linux kernel across multiple distributions including Ubuntu, Debian, Red Hat, SUSE, Amazon Linux, and Microsoft Azure Linux (azl3_kernel versions 6.6.112.1-2 and 6.6.117.1-1). It carries a CVSS v3.1 base score of 6.3 (Medium) (Feedly).

The root cause is a race condition (CWE-362) in net/mptcp/pm.c within the Linux kernel's MPTCP implementation. When mptcp_pm_del_add_timer() is called concurrently with code that frees the associated mptcp_pm_add_entry structure, the function may attempt to call sk_stop_timer_sync() on an already-freed timer object, triggering a slab-use-after-free detected by KASAN at __timer_delete_sync+0x372/0x3f0. The fix adds RCU (Read-Copy-Update) protection to the entry lookup path and renames the confusing add_timer variable to a stop_timer boolean for clarity. Exploitation requires local access with low privileges and high attack complexity due to the timing-dependent nature of the race (Feedly).

Successful exploitation of this vulnerability can lead to kernel memory corruption, system instability, or kernel panic (denial of service). In some scenarios, the use-after-free condition could potentially allow an attacker with low-privileged local access to read sensitive kernel memory, impacting confidentiality. The availability impact is rated high, as kernel crashes or instability can render the affected system inoperable (Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.018%, reflecting minimal near-term exploitation probability. Exploitation requires local access, low privileges, and precise timing to trigger the race condition, making opportunistic exploitation unlikely (Feedly).

The primary remediation is to update to a patched Linux kernel version. Patches have been issued across multiple distributions: Ubuntu (USN-8094-x, USN-8096-x, USN-8152-1 series), Debian (DLA-4436-1), Red Hat (RHSA-2026:18134), SUSE, Amazon Linux 2 (ALAS2KERNEL-5.15-2025-096, ALAS2KERNEL-5.10-2026-112), Oracle Linux, and Microsoft Azure Linux. For systems that cannot be patched immediately, consider disabling or restricting MPTCP functionality and enabling kernel runtime protections (e.g., KASAN, SMEP/SMAP). Monitor for unusual kernel activity related to networking subsystems (Ubuntu Advisory, Red Hat Advisory, Amazon Linux Advisory).