Red Hat Fixes Linux Kernel TCP Fast Open Use-After-Free in RHEL 10

Red Hat released RHSA-2025:21931 kernel updates for Red Hat Enterprise Linux 10 that remediate CVE-2025-39955, a TCP Fast Open (TFO) state-management flaw. The vulnerability occurs when a server-side TFO socket is reused as a client before its prior TFO operation completes, potentially leaving tcp_sk(sk)->fastopen_rsk referencing a freed request_sock; a retransmission timer may then access the stale object, causing a kernel warning and potentially enabling use-after-free or information-disclosure conditions.

Red Hat rates the issue Moderate severity with a CVSS v3.1 score of 7.6 and notes that exploitation requires local access and the ability to create and manipulate TFO sockets, typically in privileged or test environments. The advisory updates RHEL 10 kernels for x86_64, s390x, ppc64le, and aarch64, including applicable extended-support variants; it also fixes the NFS filehandle bounds-checking vulnerability CVE-2025-39730. Organizations should apply the updated kernel packages and reboot affected hosts.