CVE-2025-40248

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-40248
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40248.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-40248
Downstream
Related
Published
2025-12-04T16:08:11.509Z
Modified
2026-03-12T02:17:27.688261Z
Summary
vsock: Ignore signal/timeout on connect() if already established
Details

In the Linux kernel, the following vulnerability has been resolved:

vsock: Ignore signal/timeout on connect() if already established

During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues:

  1. connect() invoking vsocktransportcancelpkt() -> virtiotransportpurgeskbs() may race with sendmsg() invoking virtiotransportgetcredit(). This results in a permanently elevated vvs->bytes_unsent. Which, in turn, confuses the SOCKLINGER handling.

  2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs.

  3. connect() transitioning SSCONNECTED -> SSUNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref.

Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg().

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40248.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d021c344051af91f42c5ba9fdedc176740cbd238
Fixed
3f71753935d648082a8279a97d30efe6b85be680
Fixed
da664101fb4a0de5cb70d2bae6a650df954df2af
Fixed
67432915145848658149683101104e32f9fd6559
Fixed
eeca93f06df89be5a36305b7b9dae1ed65550dfc
Fixed
5998da5a8208ae9ad7838ba322bccb2bdcd95e81
Fixed
f1c170cae285e4b8f61be043bb17addc3d0a14b5
Fixed
ab6b19f690d89ae4709fba73a3c4a7911f495b7a
Fixed
002541ef650b742a198e4be363881439bb9d86b4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40248.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.9.0
Fixed
5.4.302
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.247
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.197
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.159
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.118
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.60
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.17.10

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40248.json"