External risk intelligence

Linux Kernel MPTCP Race Condition Use-After-Free.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-40258

This is a low-level race condition within the Linux kernel's MultiPath TCP (MPTCP) implementation. It relates to internal kernel task scheduling and memory management. It is not a service or application endpoint, nor is it exposed directly to the internet; exploitation would require local execution or complex, specific conditions unrelated to typical network-facing service exposure.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recently addressed vulnerability in the Linux kernel's MultiPath TCP (MPTCP) implementation involved a race condition that could lead to a use-after-free error. This issue stemmed from how internal tasks were scheduled and managed, potentially impacting system stability. While the vulnerability has been resolved, confirming its relevance to our environment is the primary concern.

Race condition in kernel task scheduling fixed.
Matters for system stability and memory integrity.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a race condition within the Linux kernel's MultiPath TCP (MPTCP) functionality. This vulnerability arises from how the kernel schedules internal tasks and manages memory for network sockets. Successful exploitation could lead to significant system compromise.

Entry Condition: Local code execution or specific network conditions.
Trigger Point: Interaction with MPTCP task scheduling.
Resulting Risk: System instability and potential data corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's MultiPath TCP (MPTCP) implementation could lead to a use-after-free error. This condition may occur when MPTCP schedules internal work and a race condition allows the work to complete before the system properly manages the reference count of the associated socket. This could potentially affect the stability and integrity of the kernel's networking operations.

Kernel socket reference counts.
Race condition in work scheduling.
System instability or crashes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the Linux kernel's MultiPath TCP (MPTCP) implementation and likely impacts teams responsible for kernel maintenance or the systems running MPTCP-enabled services. The first practical step is to identify systems utilizing MPTCP, assess their exposure and business criticality, and then coordinate with the relevant kernel or system owners for remediation planning.

Kernel and platform teams own resolution.
Verify MPTCP usage and system criticality.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel MPTCP component?

MultiPath TCP (MPTCP) is a core Linux kernel feature that allows a single data connection to be split across multiple network paths simultaneously, such as using Wi-Fi and cellular data at once to improve performance and reliability. It is a fundamental networking protocol stack handled deep within the operating system, rather than a standalone user-facing application.

What is the cause of CVE-2025-40258?

This CVE describes a race condition—a timing-related flaw—within the Linux kernel's MPTCP task scheduling logic. Specifically, the kernel sometimes releases control of a network socket before it has finished referencing it. This can lead to a 'use-after-free' memory error, where the system attempts to access memory that has already been deallocated, potentially causing system instability or crashes.

How does this MPTCP race condition get triggered?

The flaw is triggered during internal kernel task scheduling when MPTCP work is being processed. It occurs if the background worker completes its task before the kernel has securely locked the associated socket's reference count. Simply having network traffic does not guarantee this will occur; it requires a specific, overlapping sequence of events in the kernel's execution timing.

Is my system vulnerable according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is very unlikely to be reachable from the internet. Because the flaw exists within low-level kernel memory management for MPTCP, it is not an exposed service or endpoint. Successful exploitation would generally require local access or highly specific, complex environmental conditions that go far beyond typical network-facing interactions.

How should I respond to CVE-2025-40258?

The most effective first step is to identify which of your servers or platforms have MPTCP enabled. Once identified, evaluate the criticality of those systems. Since this is a kernel-level issue, remediation involves coordinating with your system or kernel engineering teams to plan for standard security updates during your regular maintenance windows.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.