CVE-2025-39955: Linux Kernel DOS Vulnerability

CVE-2025-39955 Overview

CVE-2025-39955 is a Linux kernel vulnerability in the TCP subsystem. The flaw resides in tcp_disconnect(), which fails to clear tcp_sk(sk)->fastopen_rsk when a TCP Fast Open (TFO) socket is disconnected before the three-way handshake completes. A local attacker who reuses a server-side TFO socket as a new client through the sequence accept() → connect(AF_UNSPEC) → connect() to another destination can trigger a stale request socket reference. The retransmit timer then fires against freed state, producing a kernel warning and preventing intended packet retransmission. The issue affects Linux kernel 6.17 release candidates and earlier stable branches.

Critical Impact
A local, low-privileged user can corrupt TCP socket state and disrupt kernel networking through crafted TFO socket reuse, with potential for memory safety impact on confidentiality, integrity, and availability.

Affected Products

Linux kernel 6.17-rc1 through 6.17-rc6
Linux kernel stable branches prior to the fix commits
Siemens products embedding affected Linux kernel versions (per Siemens Security Advisory SSA-019113)

Discovery Timeline

2025-10-09 - CVE-2025-39955 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2025-39955

Vulnerability Analysis

The vulnerability affects the Linux kernel TCP Fast Open state machine. TCP Fast Open allows data to be exchanged during the initial SYN, and the kernel tracks the pending request socket via the fastopen_rsk pointer on the parent socket. When user space calls accept() on a listening socket before the three-way handshake completes, sk->sk_state remains TCP_SYN_RECV and fastopen_rsk still references the request socket.

Invoking connect(AF_UNSPEC) triggers tcp_disconnect(), which transitions the socket to TCP_CLOSE and permits a fresh connect() to a new destination. The prior implementation of tcp_disconnect() did not invoke reqsk_fastopen_remove(), leaving the fastopen_rsk pointer intact on a socket that has been repurposed. When the retransmit timer subsequently fires, tcp_retransmit_timer() in net/ipv4/tcp_timer.c observes the inconsistent state and triggers a WARN_ON at line 542, while the packet the kernel intended to retransmit is dropped.

Root Cause

The root cause is missing cleanup of TCP Fast Open request socket state during socket disconnection. tcp_disconnect() reset the connection state and restarted timers but omitted the call to reqsk_fastopen_remove(), leaving a dangling reference in tcp_sk(sk)->fastopen_rsk. This constitutes an improper state management defect in the kernel networking stack [CWE-noinfo assigned by NVD].

Attack Vector

Exploitation requires local access with the ability to open TCP sockets. The reproducer discovered by syzbot performs three sequential operations on a server-side TFO socket: accept() while the socket is still in TCP_SYN_RECV, connect(AF_UNSPEC) to force disconnection, then connect() to a new destination. This sequence transitions a socket carrying an unresolved TFO request into TCP_CLOSE and then into a new active connection, leaving the stale fastopen_rsk in place until the retransmit timer expires.

The vulnerability was originally reported through the syzbot kernel fuzzing infrastructure. No public proof-of-concept beyond the syzbot reproducer is currently available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Full technical details are available in the kernel commit series and the Siemens Security Advisory SSA-019113.

Detection Methods for CVE-2025-39955

Indicators of Compromise

Kernel warnings referencing tcp_retransmit_timer at net/ipv4/tcp_timer.c:542 in dmesg or journalctl -k output
Unexpected TCP connection resets or missing retransmissions on hosts running affected kernels
Processes performing rapid accept() → connect(AF_UNSPEC) → connect() sequences against TFO-enabled listeners

Detection Strategies

Monitor kernel ring buffer for WARNING: CPU: ... at net/ipv4/tcp_timer.c messages, which indicate the state inconsistency has been triggered
Audit workloads that enable TCP_FASTOPEN (net.ipv4.tcp_fastopen) and disconnect sockets through AF_UNSPECconnect() calls
Correlate kernel version telemetry against the affected 6.17-rc range and unpatched stable branches

Monitoring Recommendations

Enable persistent kernel log collection and forward WARN_ON events to a centralized logging pipeline for retention
Track syscall patterns on multi-tenant hosts using auditd or eBPF probes on sys_connect and sys_accept4
Alert on repeated retransmit timer warnings from the same PID or namespace, which suggest deliberate triggering

How to Mitigate CVE-2025-39955

Immediate Actions Required

Inventory Linux hosts running kernel 6.17-rc1 through 6.17-rc6 and any unpatched stable branches identified in the kernel.org advisories
Apply the upstream fix that adds reqsk_fastopen_remove() to tcp_disconnect() as soon as vendor packages are available
On systems that cannot be patched immediately, restrict local shell access on multi-tenant hosts to reduce exposure to local exploitation

Patch Information

The fix has been backported across multiple stable trees. The relevant commits are 17d699727577, 33a4fdf0b4a2, 45c8a6cc2bcd, 7ec092a91ff3, a4378dedd6e0, ae313d14b45e, dfd06131107e, and fa4749c06564, published on git.kernel.org/stable. The patch calls reqsk_fastopen_remove() inside tcp_disconnect() to clear the stale request socket reference before state transitions and timer restarts. Distribution kernels should be updated to include these commits. Siemens has published guidance for affected embedded products in Siemens Security Advisory SSA-019113.

Workarounds

Disable TCP Fast Open where operationally acceptable by setting net.ipv4.tcp_fastopen=0 via sysctl to eliminate the vulnerable code path
Remove TCP_FASTOPEN socket option usage from application listeners on affected hosts until kernels are patched
Constrain untrusted local users through mandatory access control policies (SELinux, AppArmor) to limit socket manipulation on shared systems

bash

# Temporarily disable TCP Fast Open until the kernel is patched
sudo sysctl -w net.ipv4.tcp_fastopen=0

# Persist the setting across reboots
echo 'net.ipv4.tcp_fastopen = 0' | sudo tee /etc/sysctl.d/99-cve-2025-39955.conf
sudo sysctl --system

# Verify the running kernel version against affected 6.17-rc builds
uname -r