Use-After-Free Vulnerability in TIPC Component of Linux Kernel

CVE-2025-40280

What is CVE-2025-40280?

A use-after-free vulnerability was identified within the TIPC (Transparent Inter-Process Communication) component of the Linux Kernel. This vulnerability occurs due to incorrect handling of the monitor array in the tipc_mon_reinit_self() function, which iterates over the array without proper protection mechanisms. Specifically, while the array is typically safeguarded by RTNL (Read/Write lock for network stack), inadequate synchronization during certain operations could lead to memory access violations. An attacker could exploit this flaw, potentially leading to memory corruption and unauthorized access, thus affecting system stability and security.

References