Executive brief
A vulnerability was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation, which is used to improve network performance by using multiple paths for data. A flaw in how the system handles network connection 'fallbacks' could allow a local user to cause a system crash or instability. This issue primarily impacts the availability of the affected system.
Technical details
A race condition exists in the MPTCP (MultiPath TCP) protocol implementation within the Linux kernel due to improper locking when handling fallback decisions. The 'fallback is possible' condition and the actual fallback status were tracked separately without atomic synchronization, leading to inconsistent states reported by Syzkaller. An attacker with local access could potentially trigger this race condition to cause a kernel panic or Denial of Service (DoS). The fix introduces a spinlock to ensure that fallback actions and decisions are performed atomically. Patches have been released for various stable kernel branches including 5.10, 6.6, and 6.16.
Affected products
- Linux Linux Kernel 5.10.228 to 5.11, 6.2 to 6.6.101, 6.16-rc1 to 6.16-rc5
Timeline
- 2025-07-14: other: Patch authored by Paolo Abeni
- 2025-07-24: patched: Patch committed to stable tree
- 2025-07-28: advisory: CVE published
References
- https://git.kernel.org/stable/c/1d82a8fe6ee4afdc92f4e8808c9dad2a6095bbc5
- https://git.kernel.org/stable/c/54999dea879fecb761225e28f274b40662918c30
- https://git.kernel.org/stable/c/5586518bec27666c747cd52aabb62d485686d0bf
- https://git.kernel.org/stable/c/75a4c9ab8a7af0d76b31ccd1188ed178c38b35d2
- https://git.kernel.org/stable/c/f8a1d9b18c5efc76784f5a326e905f641f839894
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html