Executive brief
A flaw was discovered in the Linux kernel's MultiPath TCP (MPTCP) implementation that can lead to a system deadlock. This component is responsible for managing network connections across multiple paths to improve performance and reliability. An exploit could cause the system to hang or become unresponsive, resulting in a complete denial of service.
Technical details
A recursive locking vulnerability exists in the Linux kernel MPTCP protocol implementation within net/mptcp/protocol.c. The issue is triggered when the packet scheduler attempts a reinjection after receiving an MP_FAIL signal but before the infinite map has been transmitted. This creates a deadlock scenario because the reinjection process attempts to acquire the 'fallback_lock' while it is already held by the fallback mechanism. The vulnerability is classified as Improper Locking (CWE-667). Patches have been released for multiple stable kernel branches to explicitly avoid reinjection during this critical fallback window.
Affected products
- Linux Linux Kernel 6.1.149 to 6.1.160, and other stable branches
Timeline
- 2025-12-30: patched: Initial patch authored by Paolo Abeni
- 2026-01-14: advisory: CVE published to NVD
References
- https://git.kernel.org/stable/c/0107442e82c0f8d6010e07e6030741c59c520d6e
- https://git.kernel.org/stable/c/0ca9fb4335e726dab4f23b3bfe87271d8f005f41
- https://git.kernel.org/stable/c/252892d5a6a2f163ce18f32716e46fa4da7d4e79
- https://git.kernel.org/stable/c/50f47c02be419bf0a3ae94c118addf67beef359f
- https://git.kernel.org/stable/c/ffb8c27b0539dd90262d1021488e7817fae57c42