Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash or instability. The issue occurs when the system handles specific types of simultaneous network connections using the Multipath TCP (MPTCP) protocol. This could lead to a denial-of-service condition, impacting the availability of affected servers or industrial controllers.
Technical details
A race condition exists in the MPTCP (Multipath TCP) subflow handling within the Linux kernel. When a simultaneous connect occurs, a TCP subflow can process a SYN-ACK packet after transitioning to the TCP_FIN_WAIT1 state. Because the sk_state_change() callback is not invoked for transitions to FIN_WAIT1, the MPTCP fallback check is bypassed. This results in an inconsistent socket state, causing a kernel splat (warning/panic) in subflow_data_ready() when subsequent data is received. The fix moves the simultaneous-fallback check to the SYN-ACK generation stage to ensure consistent state transitions.
Affected products
- Linux Linux Kernel v5.10 and later
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-01-13: advisory: NVD publication date
- 2026-01-08: patched: Patch committed to stable tree
References
- https://git.kernel.org/stable/c/25f1ae942c097b7ae4ce5c2b9c6fefb8e3672b86
- https://git.kernel.org/stable/c/71154bbe49423128c1c8577b6576de1ed6836830
- https://git.kernel.org/stable/c/79f80a7a47849ef1b3c25a0bedcc448b9cb551c1
- https://git.kernel.org/stable/c/b5f46a08269265e2f5e87d855287d6d22de0a32b
- https://git.kernel.org/stable/c/c9bf315228287653522894df9d851e9b43db9516
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html