TCP Fast Open Vulnerability in Linux Kernel

CVE-2025-39955

What is CVE-2025-39955?

A vulnerability has been identified in the Linux kernel's TCP Fast Open feature. In specific scenarios, the TCP state management can incorrectly preserve the fast open request socket in certain conditions. When a socket transitions through states, specifically from TCP_ESTABLISHED to TCP_CLOSE, the vulnerability arises if the fastopen_rsk is not cleared, potentially leading to retransmission timer warnings and disrupting the expected packet flow. This could lead to network inefficiencies and compromised TCP connections, emphasizing the need for timely updates and patches to mitigate such risks.

References