Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again. Break the recursion loop explicitly checking for the exceptional condition. Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time. This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling. Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-25T11:17:02.520Z",
  "pubdate": "2026-09-25T11:17:02.520Z",
  "executiveSummary": "A recursion vulnerability exists in the Linux kernel MPTCP (Multipath TCP) implementation, specifically within the data receive path.\nThe vulnerability occurs due to the re-entrant invocation of mptcp_data_ready() via state change notifications during exceptional error conditions, leading to potential deadlocks or memory corruption when the subflow attempts to re-acquire the data lock.\nThis flaw affects systems utilizing the MPTCP protocol stack. If triggered, the vulnerability can lead to kernel-level deadlocks, denial-of-service (DoS) conditions, or inconsistent state transitions.\nThe issue manifests when a subflow encounters specific error conditions that trigger a reset simultaneously with data reception processing.\nExploitation requires an attacker to successfully induce specific network-level error conditions that trigger the re-entrant call chain during the MPTCP receive path processing.\nSuccessful exploitation risks system instability and service interruption, necessitating a kernel patch to explicitly manage subflow state transitions and prevent redundant, recursive queue processing.",
  "technicalDetails": "The root cause of this vulnerability lies in the MPTCP receive path handling, where the function mptcp_data_ready() can be invoked recursively during subflow state changes. Under specific error conditions (e.g., unexpected subflow resets), the state change notification path triggers further processing that attempts to acquire the MPTCP data lock already held by the initial receive path thread.\nWhen a subflow encounters a reset, the existing logic in subflow_state_change() triggers a sequence of events, including potential calls to mptcp_data_ready(). If the kernel is already within the context of the receive path, this recursion results in a deadlock as the thread attempts to re-acquire the mutex protecting the socket data.\nFurthermore, the current implementation risks unnecessary and dangerous processing of dying subflows. Without explicit early exits, the kernel attempts to invoke get_mapping_status() and other related helper functions on a subflow that has already initiated a reset sequence. This could lead to accessing invalidated memory structures if the reset has already freed the associated socket buffers.\nThe attack flow involves an attacker sending crafted packets designed to force the MPTCP subflow into a state of flux. By inducing a reset at the precise moment a data packet is being processed by the receiver, the attacker triggers the recursive path.\nA critical concern noted in the analysis is the handling of peeked SKBs (socket buffers). If the kernel invokes mptcp_dss_corruption (often triggered during reset-related error handling) without consuming the peeked SKB, the same buffer may be processed multiple times. This creates a race condition where the buffer might be freed by the reset logic while the receive path is still referencing it, leading to a use-after-free or double-free scenario.\nThe remediation involves introducing a new, explicit flag within the subflow structure to track the reset status. This flag enables subflow_state_change() to exit early, preventing the redundant execution of data processing routines. Additionally, the kernel now mandates that the receive queue is explicitly flushed at the moment of the reset, ensuring no stale or peeked buffers persist that could trigger subsequent corruption or recursion."
}