Riskcovery

CVE-2023-54085

mptcp: fix NULL pointer dereference on fastopen early fallback

State
Published
Severity
7.5 High
Published
Dec 24, 2025
Updated
Oct 15, 2026
Reserved
Dec 24, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix NULL pointer dereference on fastopen early fallback

In case of early fallback to TCP, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated sock to the caller.

The fastopen path does not cope with the above unconditionally dereferencing the subflow context.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 36b122baf6a8bd46b4a591f12f4ed17b22257408 to before 95135835519b0ab931c39908b2c99e9fb3c9068bAffected
  • 36b122baf6a8bd46b4a591f12f4ed17b22257408 to before c0ff6f6da66a7791a32c0234388b1bdc00244917Affected
LinuxLinux
  • 6.2Affected
  • before 6.2Not affected
  • 6.2.12 through 6.2.*Not affected
  • 6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.