Executive brief
A vulnerability has been identified in the Linux kernel's MultiPath TCP (MPTCP) implementation, which is used to improve network performance by combining multiple connections. A race condition exists that could allow unauthorized network activity or subflow creation during specific failure states. This could potentially lead to service instability or unauthorized data manipulation in systems relying on MPTCP for network communication.
Technical details
A race condition exists in the MPTCP (MultiPath TCP) subsystem of the Linux kernel between subflow failure handling and the creation of additional subflows. The vulnerability stems from insufficient locking when accessing the 'allow_infinite_fallback' field and managing socket state transitions during MP_FAIL events. An attacker can exploit this race to bypass intended restrictions on subflow creation after a fallback has occurred. The fix introduces a dedicated 'allow_subflows' flag protected by the 'fallback_lock' to ensure atomic state transitions. Impacted versions include Linux kernels from 5.15 up to 6.15.8, with patches available in stable branches (e.g., 6.1.149, 6.6.101, 6.12.40).
Affected products
- Linux Linux Kernel 5.15 to 6.15.8
- Siemens SIMATIC CN 4100 before V5.0
Timeline
- 2025-07-14: patched: Initial patch authored by Paolo Abeni
- 2025-08-16: advisory: CVE-2025-38552 published
References
- https://git.kernel.org/stable/c/659da22dee5ff316ba63bdaeeac7b58b5442f6c2
- https://git.kernel.org/stable/c/7c96d519ee15a130842a6513530b4d20acd2bfcd
- https://git.kernel.org/stable/c/c476d627584b7589a134a8b48dd5c6639e4401c5
- https://git.kernel.org/stable/c/def5b7b2643ebba696fc60ddf675dca13f073486
- https://git.kernel.org/stable/c/f81b6fbe13c7fc413b5158cdffc6a59391a2a8db
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html