Riskcovery

CVE-2024-53122

mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

State
Published
Severity
7.5 High
Published
Dec 2, 2024
Updated
Oct 15, 2026
Reserved
Nov 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs.

A racing recvmsg() spooling data received on an already established subflow would unconditionally call tcp_cleanup_rbuf() on all the current subflows, potentially hitting a divide by zero error on the newly created ones.

Explicitly check that the subflow is in a suitable state before invoking tcp_cleanup_rbuf().

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c76c6956566f974bac2470bd72fc22fb923e04a1 to before 0a9a182ea5c7bb0374e527130fd85024ace7279bAffected
  • c76c6956566f974bac2470bd72fc22fb923e04a1 to before 24995851d58c4a205ad0ffa7b2f21e479a9c8527Affected
  • c76c6956566f974bac2470bd72fc22fb923e04a1 to before ff825ab2f455299c0c7287550915a8878e2a66e0Affected
  • c76c6956566f974bac2470bd72fc22fb923e04a1 to before aad6412c63baa39dd813e81f16a14d976b3de2e8Affected
  • c76c6956566f974bac2470bd72fc22fb923e04a1 to before ce7356ae35943cc6494cc692e62d51a734062b7dAffected
LinuxLinux
  • 5.10Affected
  • before 5.10Not affected
  • 5.15.174 through 5.15.*Not affected
  • 6.1.119 through 6.1.*Not affected
  • 6.6.63 through 6.6.*Not affected
  • 6.11.10 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.