Junglewise Threat Intelligence

CVE-2025-68291: Linux Kernel divide-by-zero in MPTCP mptcp_do_fastclose

CVE-2025-68291 · Severity: info · CVSS 0 · Published 2025-12-16

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation, which is also used in certain Siemens industrial controllers. The flaw can cause a system crash (kernel panic) when a specific type of network connection closure occurs. This could lead to a denial-of-service, impacting the availability of affected servers or industrial equipment.

Technical details

A divide-by-zero vulnerability exists in the Linux kernel within the '__tcp_select_window()' function when handled by an MPTCP socket. The root cause is the failure to initialize 'rcv_mss' before calling 'tcp_send_active_reset()' in 'mptcp_do_fastclose()'. When 'rcv_mss' is 0, it triggers a division error during TCP window selection, resulting in a kernel panic. This can be triggered remotely via network traffic that forces an MPTCP fast-close scenario. Patches have been released for various stable Linux kernel branches (e.g., 6.1.y, 6.6.y, 6.11.y, 6.12.y).

Affected products

  • Linux Linux Kernel Affected before fixed versions in 6.1, 6.6, 6.11, 6.12, and 6.13 branches
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and all versions less than *
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6 and all versions less than *
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and all versions less than *

Timeline

  • 2025-11-25: disclosed: Initial patch submitted by Kuniyuki Iwashima
  • 2025-12-07: patched: Patch committed to stable kernel trees
  • 2025-12-16: advisory: CVE-2025-68291 published

References

Related threats