CVE-2025-39955

A flaw was found in the TCP subsystem in tcp_disconnect of the Linux kernel.The server-side TCP Fast Open socket was reused as a new client before the TFO socket completes, leading to an information leak.

tcp_disconnect() failed to clear tcp_sk(sk)->fastopen_rsk when reusing a TFO socket (e.g., after accept() → connect(AF_UNSPEC) → connect() sequence). This left a stale reference, allowing the retransmit timer to access a freed request_sock, triggering a kernel warning or potential UAF. Triggering requires local access and the ability to create and manipulate TCP Fast Open sockets (often through privileged or test contexts).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.