Executive brief
A vulnerability was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation, which is used to improve network performance by using multiple paths simultaneously. The flaw could allow a remote attacker to cause a system crash or potentially execute unauthorized actions by exploiting a memory management error during network connection setup. This could impact the availability of servers or devices using MPTCP for high-performance networking.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's MPTCP implementation within the mptcp_active_enable() function. The issue arises because mptcp_active_enable() is called from subflow_finish_connect() without consistent RCU (Read-Copy-Update) protection when accessing the destination device (dst->dev). An attacker could potentially exploit this race condition to trigger a UAF state. The fix involves using __sk_dst_get() and dst_dev_rcu() within an RCU read-side critical section to ensure safe pointer dereferencing. Patches have been released for various stable kernel branches including 6.12.x and 6.17.x.
Affected products
- Linux Linux Kernel 6.12 to 6.12.55, 6.17 to 6.17.3
Timeline
- 2025-09-16: patched: Initial fix authored by Kuniyuki Iwashima
- 2025-11-12: disclosed: CVE-2025-40133 published