Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: close race between scheduler and state change The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mss_now reset to 0 for a divide operation. Address the issue by explicitly checking for the critical scenario.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-25T11:17:02.407Z",
  "pubdate": "2026-09-25T11:17:02.407Z",
  "executiveSummary": "This vulnerability is identified as a race condition within the MPTCP (Multi-Path TCP) scheduler component of the Linux kernel.\nThe flaw emerges due to inadequate synchronization between subflow socket state transitions and the packet scheduling process, leading to a potential kernel panic.\nThe primary impact is a Denial of Service (DoS) resulting from a division-by-zero error when the scheduler attempts to utilize an improperly initialized or reset mss_now value.\nAffected systems include any Linux kernel implementation utilizing the MPTCP protocol stack where subflow states can transition during an active scheduling operation.\nThe risk implication is high for high-availability systems relying on MPTCP, as an attacker capable of triggering subflow state changes during active transmission can cause a system-wide crash.\nExploitation does not necessarily require complex payloads; rather, it relies on precisely timing the subflow state change in relation to the MPTCP scheduler to trigger the integer division exception.",
  "technicalDetails": "The root cause of this vulnerability lies in an unprotected concurrency window between the MPTCP scheduler and subflow socket state changes. In the Linux kernel's MPTCP implementation, the scheduler is responsible for selecting the optimal subflow for data transmission. However, if a subflow state change occurs concurrently, the socket state can transition while the scheduler is mid-operation.\nSpecifically, when data transmission on a selected subflow fails due to these state transitions, the subsequent socket release process may reset internal variables, including mss_now, to zero. If the scheduler proceeds to utilize this reset value within a division operation—typically used to calculate segment sizes or transmission parameters—the CPU generates a hardware exception, resulting in a kernel panic.\nThe attack flow proceeds as follows: An attacker initiates an MPTCP connection and generates traffic to force the MPTCP scheduler to actively select specific subflows. The attacker then triggers a subflow socket state change—for example, by forcing a subflow teardown or error condition during the transmission window. If the timing aligns such that the scheduler has identified a subflow but not yet completed the associated calculations, the scheduler will access the socket structures currently undergoing modification.\nBecause the mss_now variable is reset to zero during the state change teardown, the subsequent division operation in the scheduler's logic encounters a zero divisor. This flaw exposes the kernel to memory corruption or, more commonly, an immediate crash of the kernel thread, leading to a local or network-reachable Denial of Service.\nThis issue highlights the necessity for stricter locking mechanisms or atomic state checks within the MPTCP scheduler component. Current remediation involves the introduction of an explicit check to validate the state of the socket and the integrity of the mss_now value before attempting any arithmetic operations involving that variable. The vulnerability is fundamentally a failure in the synchronization primitives between the MPTCP subflow state machine and the transmission scheduler, allowing for an inconsistent state to be observed by the scheduler logic."
}