CVE-2025-40248

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40248", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.181Z", "datePublished": "2025-12-04T16:08:11.509Z", "dateUpdated": "2026-08-05T12:08:50.554Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:50.554Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Ignore signal/timeout on connect() if already established\n\nDuring connect(), acting on a signal/timeout by disconnecting an already\nestablished socket leads to several issues:\n\n1. connect() invoking vsock_transport_cancel_pkt() ->\n virtio_transport_purge_skbs() may race with sendmsg() invoking\n virtio_transport_get_credit(). This results in a permanently elevated\n `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.\n\n2. connect() resetting a connected socket's state may race with socket\n being placed in a sockmap. A disconnected socket remaining in a sockmap\n breaks sockmap's assumptions. And gives rise to WARNs.\n\n3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a\n transport change/drop after TCP_ESTABLISHED. Which poses a problem for\n any simultaneous sendmsg() or connect() and may result in a\n use-after-free/null-ptr-deref.\n\nDo not disconnect socket on signal/timeout. Keep the logic for unconnected\nsockets: they don't linger, can't be placed in a sockmap, are rejected by\nsendmsg().\n\n[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/\n[2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/\n[3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered through AF_VSOCK socket syscalls (connect/sendmsg) plus signal delivery from a local process; per kernel scoring guidance vsock is a local attack surface. No network packet from an unauthenticated remote peer can drive the signal/timeout race.\nAC:L - The attacker controls both sides of the race \u2014 the listening peer (vsock_loopback/VMADDR_CID_LOCAL requires no VM), the exact moment of connection establishment, the signal storm from a sibling thread, and the concurrent sendmsg()/second connect() \u2014 and can retry indefinitely until the window is hit.\nPR:L - vsock_create() performs no capability check, so any unprivileged local user (including inside a container) can create AF_VSOCK sockets and reach vsock_connect(). No root, CAP_NET_ADMIN, or namespace trickery is needed.\nUI:N - The attacker's own threads perform every step \u2014 connect, accept, signal delivery, and the follow-up connect/sendmsg. No victim action is required.\nS:U - The corruption and its impact are confined to the kernel's own security authority; there is no guest-to-host or IOMMU boundary crossing involved in the freed vsock transport state.\nC:H - The transport change/drop after TCP_ESTABLISHED yields a use-after-free of the kmalloc'd virtio_vsock_sock and a stale transport ops pointer reachable from sendmsg(); heap reclaim of the freed object gives an attacker-controlled read primitive over kernel memory.\nI:H - The same use-after-free permits heap spraying over the freed transport state and invocation of function pointers from a stale ops/module reference, providing a write and control-flow hijack primitive as in prior vsock UAF exploits.\nA:H - The commit explicitly notes use-after-free/NULL-pointer dereference, plus sockmap WARNs and a permanently elevated bytes_unsent that breaks SOCK_LINGER handling \u2014 any of which oops or hang the kernel, and the race can be re-run at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/vmw_vsock/af_vsock.c"], "versions": [{"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "3f71753935d648082a8279a97d30efe6b85be680", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "da664101fb4a0de5cb70d2bae6a650df954df2af", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "67432915145848658149683101104e32f9fd6559", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "eeca93f06df89be5a36305b7b9dae1ed65550dfc", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "5998da5a8208ae9ad7838ba322bccb2bdcd95e81", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "f1c170cae285e4b8f61be043bb17addc3d0a14b5", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "ab6b19f690d89ae4709fba73a3c4a7911f495b7a", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "002541ef650b742a198e4be363881439bb9d86b4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/vmw_vsock/af_vsock.c"], "versions": [{"version": "3.9", "status": "affected"}, {"version": "0", "lessThan": "3.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.302", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.247", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.197", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.118", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.60", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.10", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.4.302"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.10.247"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.15.197"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.1.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.6.118"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.12.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.17.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3f71753935d648082a8279a97d30efe6b85be680"}, {"url": "https://git.kernel.org/stable/c/da664101fb4a0de5cb70d2bae6a650df954df2af"}, {"url": "https://git.kernel.org/stable/c/67432915145848658149683101104e32f9fd6559"}, {"url": "https://git.kernel.org/stable/c/eeca93f06df89be5a36305b7b9dae1ed65550dfc"}, {"url": "https://git.kernel.org/stable/c/5998da5a8208ae9ad7838ba322bccb2bdcd95e81"}, {"url": "https://git.kernel.org/stable/c/f1c170cae285e4b8f61be043bb17addc3d0a14b5"}, {"url": "https://git.kernel.org/stable/c/ab6b19f690d89ae4709fba73a3c4a7911f495b7a"}, {"url": "https://git.kernel.org/stable/c/002541ef650b742a198e4be363881439bb9d86b4"}], "title": "vsock: Ignore signal/timeout on connect() if already established", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T12:59:57.735Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-16T20:01:10.557430Z", "id": "CVE-2025-40248", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T20:01:18.965Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T12:59:57.735Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40248", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T20:01:10.557430Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T20:01:14.928Z"}}], "cna": {"title": "vsock: Ignore signal/timeout on connect() if already established", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "3f71753935d648082a8279a97d30efe6b85be680", "versionType": "git"}, {"status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "da664101fb4a0de5cb70d2bae6a650df954df2af", "versionType": "git"}, {"status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "67432915145848658149683101104e32f9fd6559", "versionType": "git"}, {"status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "eeca93f06df89be5a36305b7b9dae1ed65550dfc", "versionType": "git"}, {"status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "5998da5a8208ae9ad7838ba322bccb2bdcd95e81", "versionType": "git"}, {"status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "f1c170cae285e4b8f61be043bb17addc3d0a14b5", "versionType": "git"}, {"status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "ab6b19f690d89ae4709fba73a3c4a7911f495b7a", "versionType": "git"}, {"status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "002541ef650b742a198e4be363881439bb9d86b4", "versionType": "git"}], "programFiles": ["net/vmw_vsock/af_vsock.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.9"}, {"status": "unaffected", "version": "0", "lessThan": "3.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.302", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.247", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.197", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.159", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.118", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.60", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.10", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/vmw_vsock/af_vsock.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3f71753935d648082a8279a97d30efe6b85be680"}, {"url": "https://git.kernel.org/stable/c/da664101fb4a0de5cb70d2bae6a650df954df2af"}, {"url": "https://git.kernel.org/stable/c/67432915145848658149683101104e32f9fd6559"}, {"url": "https://git.kernel.org/stable/c/eeca93f06df89be5a36305b7b9dae1ed65550dfc"}, {"url": "https://git.kernel.org/stable/c/5998da5a8208ae9ad7838ba322bccb2bdcd95e81"}, {"url": "https://git.kernel.org/stable/c/f1c170cae285e4b8f61be043bb17addc3d0a14b5"}, {"url": "https://git.kernel.org/stable/c/ab6b19f690d89ae4709fba73a3c4a7911f495b7a"}, {"url": "https://git.kernel.org/stable/c/002541ef650b742a198e4be363881439bb9d86b4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Ignore signal/timeout on connect() if already established\n\nDuring connect(), acting on a signal/timeout by disconnecting an already\nestablished socket leads to several issues:\n\n1. connect() invoking vsock_transport_cancel_pkt() ->\n virtio_transport_purge_skbs() may race with sendmsg() invoking\n virtio_transport_get_credit(). This results in a permanently elevated\n `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.\n\n2. connect() resetting a connected socket's state may race with socket\n being placed in a sockmap. A disconnected socket remaining in a sockmap\n breaks sockmap's assumptions. And gives rise to WARNs.\n\n3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a\n transport change/drop after TCP_ESTABLISHED. Which poses a problem for\n any simultaneous sendmsg() or connect() and may result in a\n use-after-free/null-ptr-deref.\n\nDo not disconnect socket on signal/timeout. Keep the logic for unconnected\nsockets: they don't linger, can't be placed in a sockmap, are rejected by\nsendmsg().\n\n[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/\n[2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/\n[3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.302", "versionStartIncluding": "3.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.247", "versionStartIncluding": "3.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.197", "versionStartIncluding": "3.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.159", "versionStartIncluding": "3.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.118", "versionStartIncluding": "3.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.60", "versionStartIncluding": "3.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.10", "versionStartIncluding": "3.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "3.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:45:39.557Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40248", "state": "PUBLISHED", "dateUpdated": "2026-06-16T20:01:18.965Z", "dateReserved": "2025-04-16T07:20:57.181Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-04T16:08:11.509Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/vmw_vsock/af_vsock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3f71753935d648082a8279a97d30efe6b85be680", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "da664101fb4a0de5cb70d2bae6a650df954df2af", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "67432915145848658149683101104e32f9fd6559", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "eeca93f06df89be5a36305b7b9dae1ed65550dfc", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "5998da5a8208ae9ad7838ba322bccb2bdcd95e81", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "f1c170cae285e4b8f61be043bb17addc3d0a14b5", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "ab6b19f690d89ae4709fba73a3c4a7911f495b7a", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "002541ef650b742a198e4be363881439bb9d86b4", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/vmw_vsock/af_vsock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.9"}, {"lessThan": "3.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.302", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.247", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.197", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.159", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.118", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.60", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V4.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Ignore signal/timeout on connect() if already established\n\nDuring connect(), acting on a signal/timeout by disconnecting an already\nestablished socket leads to several issues:\n\n1. connect() invoking vsock_transport_cancel_pkt() ->\n virtio_transport_purge_skbs() may race with sendmsg() invoking\n virtio_transport_get_credit(). This results in a permanently elevated\n `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.\n\n2. connect() resetting a connected socket's state may race with socket\n being placed in a sockmap. A disconnected socket remaining in a sockmap\n breaks sockmap's assumptions. And gives rise to WARNs.\n\n3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a\n transport change/drop after TCP_ESTABLISHED. Which poses a problem for\n any simultaneous sendmsg() or connect() and may result in a\n use-after-free/null-ptr-deref.\n\nDo not disconnect socket on signal/timeout. Keep the logic for unconnected\nsockets: they don't linger, can't be placed in a sockmap, are rejected by\nsendmsg().\n\n[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/\n[2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/\n[3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvsock: Ignorar se\u00f1al/tiempo de espera en connect() si ya est\u00e1 establecida\n\nDurante connect(), actuar sobre una se\u00f1al/tiempo de espera al desconectar un socket ya establecido conduce a varios problemas:\n\n1. connect() invocando vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() puede competir con sendmsg() invocando virtio_transport_get_credit(). Esto resulta en un permanentemente elevado vvs -> bytes_unsent. Lo cual, a su vez, confunde el manejo de SOCK_LINGER.\n\n2. connect() restableciendo el estado de un socket conectado puede competir con el socket siendo colocado en un sockmap. Un socket desconectado que permanece en un sockmap rompe las suposiciones de sockmap. Y da lugar a WARNs.\n\n3. connect() haciendo la transici\u00f3n SS_CONNECTED -> SS_UNCONNECTED permite un cambio/ca\u00edda de transporte despu\u00e9s de TCP_ESTABLISHED. Lo cual plantea un problema para cualquier sendmsg() o connect() simult\u00e1neo y puede resultar en un uso despu\u00e9s de liberaci\u00f3n/desreferencia de puntero nulo.\n\nNo desconectar el socket en se\u00f1al/tiempo de espera. Mantener la l\u00f3gica para sockets no conectados: no persisten, no pueden ser colocados en un sockmap, son rechazados por sendmsg().\n\n[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/\n[2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/\n[3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/"}], "id": "CVE-2025-40248", "lastModified": "2026-10-19T19:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40248", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-16T20:01:10.557430Z", "version": "2.0.3"}}]}, "published": "2025-12-04T16:16:18.240", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/002541ef650b742a198e4be363881439bb9d86b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3f71753935d648082a8279a97d30efe6b85be680"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5998da5a8208ae9ad7838ba322bccb2bdcd95e81"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/67432915145848658149683101104e32f9fd6559"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab6b19f690d89ae4709fba73a3c4a7911f495b7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da664101fb4a0de5cb70d2bae6a650df954df2af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eeca93f06df89be5a36305b7b9dae1ed65550dfc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1c170cae285e4b8f61be043bb17addc3d0a14b5"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: vsock: Ignore signal/timeout on connect() if already established", "id": "2418872", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418872"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvsock: Ignore signal/timeout on connect() if already established\nDuring connect(), acting on a signal/timeout by disconnecting an already\nestablished socket leads to several issues:\n1. connect() invoking vsock_transport_cancel_pkt() ->\nvirtio_transport_purge_skbs() may race with sendmsg() invoking\nvirtio_transport_get_credit(). This results in a permanently elevated\n`vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.\n2. connect() resetting a connected socket's state may race with socket\nbeing placed in a sockmap. A disconnected socket remaining in a sockmap\nbreaks sockmap's assumptions. And gives rise to WARNs.\n3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a\ntransport change/drop after TCP_ESTABLISHED. Which poses a problem for\nany simultaneous sendmsg() or connect() and may result in a\nuse-after-free/null-ptr-deref.\nDo not disconnect socket on signal/timeout. Keep the logic for unconnected\nsockets: they don't linger, can't be placed in a sockmap, are rejected by\nsendmsg().\n[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/\n[2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/\n[3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/"], "name": "CVE-2025-40248", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40248\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40248\nhttps://lore.kernel.org/linux-cve-announce/2025120430-CVE-2025-40248-506e@gregkh/T"], "threat_severity": "Important"}

{}