CVE-2025-40133: CVE-2025-40133: güvenlik açığı

Açıklama (NVD)

In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu().

Özet bilgiler

CVSS v3.1

8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

%0,51 (yüzdelik 44)

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• git.kernel.org
• git.kernel.org
• git.kernel.org