CVE-2025-40280

A use-after-free vulnerability was found in the TIPC networking subsystem of the Linux kernel. The tipc_mon_reinit_self() function accesses the monitors array without holding RTNL lock when called from tipc_net_finalize_work(). A concurrent bearer disable operation can free array elements while they're being accessed.

TIPC (Transparent Inter-Process Communication) is a cluster communication protocol not commonly enabled on standard deployments. Exploitation requires concurrent TIPC operations and network namespace manipulation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.