Executive brief
The Linux kernel's MPTCP (Multipath TCP) networking component contains a NULL pointer dereference vulnerability in its fastopen path. When the system falls back from MPTCP to standard TCP during connection setup, a critical data structure is freed prematurely, but the fastopen code attempts to access it anyway. This can cause a kernel crash, disrupting network connectivity and system availability.
Technical details
The vulnerability is a NULL pointer dereference in the MPTCP fastopen handling code (net/mptcp/fastopen.c). During early TCP fallback, the function subflow_syn_recv_sock() deletes the MPTCP subflow context before returning a newly allocated socket to the caller. However, the fastopen path does not check whether this context still exists before unconditionally dereferencing it, leading to a kernel crash. The fix adds a NULL check at the beginning of mptcp_fastopen_subflow_synack_set_params() to return early if the subflow context has been deleted. This requires network access to trigger (TCP/MPTCP connection initiation) but does not require authentication or user interaction beyond establishing a connection.
Affected products
- Linux Linux kernel 4.x, 5.x, 6.x
Timeline
- 2025-12-24: disclosed
- 2023-04-13: patched