CVE-2024-26708

mptcp: really cope with fastopen race

State: Published
Severity: 5.5 Medium
Published: Apr 3, 2024
Updated: May 11, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: really cope with fastopen race

Fastopen and PM-trigger subflow shutdown can race, as reported by syzkaller.

In my first attempt to close such race, I missed the fact that the subflow status can change again before the subflow_state_change callback is invoked.

Address the issue additionally copying with all the states directly reachable from TCP_FIN_WAIT1.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1e777f39b4d75e599a3aac8e0f67d739474f198c to before 4bfe217e075d04e63c092df9d40c608e598c2ef2Affected 1e777f39b4d75e599a3aac8e0f67d739474f198c to before e158fb9679d15a2317ec13b4f6301bd26265df2fAffected 1e777f39b4d75e599a3aac8e0f67d739474f198c to before 337cebbd850f94147cee05252778f8f78b8c337fAffected
LinuxLinux	6.2Affected before 6.2Not affected 6.6.18 through 6.6.Not affected 6.7.6 through 6.7.Not affected 6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.