CVE-2025-40258: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40258 is a use-after-free vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation, specifically within the mptcp_schedule_work() function. The flaw arises from a race condition in reference counting: a work item is scheduled before the socket reference count is incremented, allowing mptcp_worker() to complete and free the socket before sock_hold() is called. It was published on December 4, 2025, and affects the Linux kernel across multiple distributions including those used by Microsoft Azure Linux 3 and IBM Netezza Appliance. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC, IBM Advisory).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-416: Use After Free) in net/mptcp/protocol.c. In the vulnerable code path, schedule_work() is called first, and sock_hold(sk) is only invoked if the work was successfully scheduled — but the worker thread (mptcp_worker()) can execute and release the socket before sock_hold() runs, resulting in a refcount increment on an already-freed object. The fix reorders operations to call sock_hold(sk) before schedule_work(), then calls sock_put(sk) if scheduling fails. The bug was reported by syzbot, which captured a refcount_t: addition on 0; use-after-free warning in lib/refcount.c triggered via mptcp_tout_timer → mptcp_schedule_work (Microsoft MSRC). Exploitation requires local access with low privileges.

Successful exploitation could allow a low-privileged local attacker to cause kernel memory corruption via use-after-free, potentially leading to system crashes (denial of service), arbitrary code execution in kernel context, or privilege escalation. The vulnerability has high confidentiality, integrity, and availability impact on the affected system. Because exploitation occurs at the kernel level, a successful attack could compromise the entire host, including all processes and data (Microsoft MSRC, IBM Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, which limits the attack surface compared to remotely exploitable vulnerabilities (Microsoft MSRC).

The primary remediation is to update to a patched Linux kernel version. Patches were committed to the stable kernel tree (commits 3fc7723, 8f9ba1a, 035bca3, 99908e2) and are available via multiple distribution channels. Vendor-specific patches have been released by Red Hat (RHSA-2026:1143, RHSA-2026:1194, RHSA-2026:1444, RHSA-2026:1661, RHSA-2026:1662, RHSA-2026:1690, RHSA-2026:2490, RHSA-2026:2535, RHSA-2026:2560, RHSA-2026:2583), Ubuntu (USN-8094-x, USN-8096-x, USN-8152-1), SUSE, openSUSE, AlmaLinux, Rocky Linux, Amazon Linux 2, Debian (DLA-4436-1), and IBM (for Netezza Appliance). As a workaround where patching is not immediately possible, restricting low-privileged user access to MPTCP socket operations and monitoring system calls related to MPTCP can reduce risk (Microsoft MSRC, IBM Advisory, Red Hat Errata).

The vulnerability was covered in Microsoft's December 2025 Patch Tuesday cycle and noted by Rapid7 and Sophos in their respective Patch Tuesday roundups. Coverage has been largely routine, consistent with a kernel use-after-free bug that lacks public exploit code. No significant independent researcher commentary or social media discussion has been identified beyond standard vulnerability tracking and distribution advisory channels (Rapid7 Blog, Sophos Blog).