7.8

CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established

Deferred
AliasesRHSA-2026:3848RHSA-2026:3865RHSA-2026:3866
Published 04-12-2025Last modified 05-08-2026

Vulnerability summary

CVE-2025-40248 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 60 · Related 39
DLA-4404-1DLA-4436-1MGASA-2026-0017MGASA-2026-0018OPENSUSE-SU-2026:20145-1RHSA-2026:1142

Timeline

  1. 04-12-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling. 2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs. 3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref. Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg(). [1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/ [2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/ [3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu156 products
  • linuxAll versions (No fix recorded) | < 5.15.0-173.183 | < 6.8.0-106.106 | < 6.17.0-19.19
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1103.110 | < 6.8.0-1050.53 | < 6.17.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Redhat42 products
  • kpatch-patch-4_18_0-372_131_1< 0:1-12.el8_6
  • kpatch-patch-4_18_0-372_131_1-debuginfo< 0:1-12.el8_6
  • kpatch-patch-4_18_0-372_131_1-debugsource< 0:1-12.el8_6
  • kpatch-patch-4_18_0-372_137_1< 0:1-9.el8_6
  • kpatch-patch-4_18_0-372_137_1-debuginfo< 0:1-9.el8_6
Debian1 product
  • linux< 6.1.159-1 | < 6.12.63-1 | < 6.17.10-1
Linux1 product
  • linux≥ d021c344051af91f42c5ba9fdedc176740cbd238, < 3f71753935d648082a8279a97d30efe6b85be680 | ≥ d021c344051af91f42c5ba9fdedc176740cbd238, < da664101fb4a0de5cb70d2bae6a650df954df2af | ≥ d021c344051af91f42c5ba9fdedc176740cbd238, < 67432915145848658149683101104e32f9fd6559 | ≥ d021c344051af91f42c5ba9fdedc176740cbd238, < eeca93f06df89be5a36305b7b9dae1ed65550dfc | ≥ d021c344051af91f42c5ba9fdedc176740cbd238, < 5998da5a8208ae9ad7838ba322bccb2bdcd95e81 | ≥ d021c344051af91f42c5ba9fdedc176740cbd238, < f1c170cae285e4b8f61be043bb17addc3d0a14b5 | ≥ d021c344051af91f42c5ba9fdedc176740cbd238, < ab6b19f690d89ae4709fba73a3c4a7911f495b7a | ≥ d021c344051af91f42c5ba9fdedc176740cbd238, < 002541ef650b742a198e4be363881439bb9d86b4 | 3.9

4 vendors · 200 products · Showing 200 of 260

References

60 links
Show all 60 references