CVE-2025-40257

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. A race condition in the mptcp_pm_del_add_timer() function allows for a use-after-free vulnerability. This can be exploited by a local attacker to cause a denial of service (DoS), potentially leading to privilege escalation or arbitrary code execution.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because triggering the underlying race condition requires elevated network administrative capabilities (CAP_NET_ADMIN), preventing unprivileged local users from easily exploiting the defect. Although Multipath TCP support is present in the kernel, exposure is confined to environments utilizing MPTCP path management features. If triggered, the resulting memory corruption can lead to a system crash causing denial of service, with potential local privilege escalation under restricted circumstances.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.