# CVE-2025-38552: Linux Kernel race condition in MPTCP subflow creation

Source: https://junglewise.ai/threats/cve-2025-38552-linux-kernel-race-condition-in-mptcp-subflow-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-16. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2025-38552 · Severity: critical · CVSS 9.4 · Published 2025-08-16

A vulnerability has been identified in the Linux kernel's MultiPath TCP (MPTCP) implementation, which is used to improve network performance by combining multiple connections. A race condition exists that could allow unauthorized network activity or subflow creation during specific failure states. This could potentially lead to service instability or unauthorized data manipulation in systems relying on MPTCP for network communication.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC CN 4100](https://junglewise.ai/threats/technologies/simatic-cn-4100). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-38552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-38552 being exploited in the wild.

**How severe is CVE-2025-38552?** Critical severity, with a CVSS score of 9.4, published 16 August 2025.

**Which products and versions are affected?** Linux Kernel 5.15 to 6.1.149, 6.2 to 6.6.101, 6.7 to 6.12.40, 6.13 to 6.15.8, 6.16-rc1 to 6.16-rc6, 5.15 to 6.15.8; Siemens SIMATIC CN 4100 before V5.0.

**Is there a fix for CVE-2025-38552?** A patch was published on 2025-07-14: Initial patch authored by Paolo Abeni Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-38552 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-38552?** Check whether you run Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists in the MPTCP (MultiPath TCP) subsystem of the Linux kernel between subflow failure handling and the creation of additional subflows. The vulnerability stems from insufficient locking when accessing the 'allow_infinite_fallback' field and managing socket state transitions during MP_FAIL events. An attacker can exploit this race to bypass intended restrictions on subflow creation after a fallback has occurred. The fix introduces a dedicated 'allow_subflows' flag protected by the 'fallback_lock' to ensure atomic state transitions. Impacted versions include Linux kernels from 5.15 up to 6.15.8, with patches available in stable branches (e.g., 6.1.149, 6.6.101, 6.12.40).

## Affected products

- Linux Linux Kernel 5.15 to 6.15.8
- Siemens SIMATIC CN 4100 before V5.0

## Timeline

- 2025-07-14: patched: Initial patch authored by Paolo Abeni
- 2025-08-16: advisory: CVE-2025-38552 published

## References

- [https://git.kernel.org/stable/c/659da22dee5ff316ba63bdaeeac7b58b5442f6c2](https://git.kernel.org/stable/c/659da22dee5ff316ba63bdaeeac7b58b5442f6c2)
- [https://git.kernel.org/stable/c/7c96d519ee15a130842a6513530b4d20acd2bfcd](https://git.kernel.org/stable/c/7c96d519ee15a130842a6513530b4d20acd2bfcd)
- [https://git.kernel.org/stable/c/c476d627584b7589a134a8b48dd5c6639e4401c5](https://git.kernel.org/stable/c/c476d627584b7589a134a8b48dd5c6639e4401c5)
- [https://git.kernel.org/stable/c/def5b7b2643ebba696fc60ddf675dca13f073486](https://git.kernel.org/stable/c/def5b7b2643ebba696fc60ddf675dca13f073486)
- [https://git.kernel.org/stable/c/f81b6fbe13c7fc413b5158cdffc6a59391a2a8db](https://git.kernel.org/stable/c/f81b6fbe13c7fc413b5158cdffc6a59391a2a8db)
- [https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html](https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)