CVE-2025-40280 json
tipc: Fix use-after-free in tipc_mon_reinit_self().
published 2025-12-06 11 mo ago modified 2026-08-05 3 mo ago also EUVD-2025-201575
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: Fix use-after-free in tipc_mon_reinit_self().
syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0]
The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL.
tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work().
Let's hold RTNL in tipc_net_finalize_work().
[0]: BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989
CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events tipc_net_finalize_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568 kasan_check_byte include/linux/kasan.h:399 [inline] lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline] rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline] rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244 rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243 write_lock_bh include/linux/rwlock_rt.h:99 [inline] tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718 tipc_net_finalize+0x115/0x190 net/tipc/net.c:140 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
Allocated by task 6089: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657 tipc_enable_bearer net/tipc/bearer.c:357 [inline] __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047 __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline] tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393 tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline] tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x508/0x820 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/ ---truncated---
Patch / fix
- Linux Linux 4.20, 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.59, 6.17.9, 6.18
- Siemens RUGGEDCOM RST2428P V4.0
- linux Debian 12 6.1.159-1
- linux Debian 13 6.12.63-1
- linux Debian 14 6.17.9-1
debian advisories DEBIAN-CVE-2025-40280
- linux Ubuntu 22.04 LTS 5.15.0-173.183
- linux Ubuntu 24.04 LTS 6.8.0-106.106
- linux Ubuntu 25.10 6.17.0-14.14
- linux-aws Ubuntu 22.04 LTS 5.15.0-1103.110
- linux-aws Ubuntu 24.04 LTS 6.8.0-1050.53
- linux-aws Ubuntu 25.10 6.17.0-1007.7
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1103.112
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1052.55
ubuntu advisories UBUNTU-CVE-2025-40280
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-40.1
- kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-40.1
- kernel-64kb SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS, SLE High Performance Computing 15 SP4-ESPOS 5.14.21-150400.24.194.1
- kernel-syms SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 5.14.21-150400.24.194.1
- kernel-source SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 5.14.21-150400.24.194.1
- kernel-default SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +5 more 5.14.21-150400.24.194.1
- kernel-obs-build SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 5.14.21-150400.24.194.1
- kernel-default-base SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 5.14.21-150400.24.194.1.150400.24.98.3
suse advisories SUSE-SU-2026:20845-1SUSE-SU-2026:20876-1SUSE-SU-2026:0617-1SUSE-SU-2026:20477-1SUSE-SU-2026:20498-1SUSE-SU-2026:0411-1
- kernel-rt openSUSE Leap 16.0 6.12.0-160000.9.1
- dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-64kb openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-syms openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-azure openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-source openSUSE Leap 16.0 6.12.0-160000.9.1
- kernel-default openSUSE Leap 16.0 6.12.0-160000.9.1
opensuse advisories openSUSE-SU-2026:20145-1
- git.kernel.org/stable/c/5f541300b02ef8b2af34f6f7d41ce617f3571e88 commit
- git.kernel.org/stable/c/b2e77c789c234e7fe49057d2ced8f32e2d2c7901 commit
- git.kernel.org/stable/c/51b8f0ab888f8aa5dfac954918864eeda8c12c19 commit
- git.kernel.org/stable/c/499b5fa78d525c4450ebb76db83207db71efea77 commit
- git.kernel.org/stable/c/c92dbf85627b5c29e52d9c120a24e785801716df commit
- git.kernel.org/stable/c/f0104977fed25ebe001fd63dab2b6b7fefad3373 commit
- git.kernel.org/stable/c/fdf7c4c9af4f246323ce854e84b6aec198d49f7e commit
- git.kernel.org/stable/c/0725e6afb55128be21a2ca36e9674f573ccec173 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-40280 updated cvss 5.5
kernel: tipc: Fix use-after-free in tipc_mon_reinit_self()
-
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernelaffected: no fix available “Fix deferred”
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-26-188-05 updated cvss 5.5
Siemens SINEC OS
-
Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < 4.0affected: fixed in V4.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Linux Linux
- Siemens RUGGEDCOM RST2428P
Classification
- Technology feeds
References
- git.kernel.org /stable/c/5f541300b02ef8b2af34f6f7d41ce617f3571e88
- git.kernel.org /stable/c/b2e77c789c234e7fe49057d2ced8f32e2d2c7901
- git.kernel.org /stable/c/51b8f0ab888f8aa5dfac954918864eeda8c12c19
- git.kernel.org /stable/c/499b5fa78d525c4450ebb76db83207db71efea77
- git.kernel.org /stable/c/c92dbf85627b5c29e52d9c120a24e785801716df
- git.kernel.org /stable/c/f0104977fed25ebe001fd63dab2b6b7fefad3373
- git.kernel.org /stable/c/fdf7c4c9af4f246323ce854e84b6aec198d49f7e
- git.kernel.org /stable/c/0725e6afb55128be21a2ca36e9674f573ccec173
- cert-portal.siemens.com /productcert/html/ssa-253495.html
Sources
- CVE List CVE-2025-40280
- NVD CVE-2025-40280
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.