CVE-2023-54176: mptcp: stricter state check in mptcp_worker

Published Dec 30, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mptcp: stricter state check in mptcpworker

As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state:

connect() // incoming reset + fastclose // the mptcp worker is scheduled mptcpdisconnect() // msk is now CLOSED listen() mptcpworker()

Leading to the following splat:

divide error: 0000 [#1] PREEMPT SMP CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcpworker RIP: 0010:tcpselectwindow+0x22c/0x4b0 net/ipv4/tcpoutput.c:3018 RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293 RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004 RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000 R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcpselectwindow net/ipv4/tcpoutput.c:262 [inline] tcptransmitskb+0x356/0x1280 net/ipv4/tcpoutput.c:1345 tcptransmitskb net/ipv4/tcpoutput.c:1417 [inline] tcpsendactivereset+0x13e/0x320 net/ipv4/tcpoutput.c:3459 mptcpcheckfastclose net/mptcp/protocol.c:2530 [inline] mptcpworker+0x6c7/0x800 net/mptcp/protocol.c:2705 processonework+0x3bd/0x950 kernel/workqueue.c:2390 workerthread+0x5b/0x610 kernel/workqueue.c:2537 kthread+0x138/0x170 kernel/kthread.c:376 retfromfork+0x2c/0x50 arch/x86/entry/entry64.S:308 </TASK>

This change addresses the issue explicitly checking for bad states before running the mptcp worker.

Affected Software

121 affected componentsFixes available
linux-kernel
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.15<5.15.0-1041.46~20.04.1
5.15.0-1041.46~20.04.1
ubuntu/linux-azure-5.15<5.15.0-1045.52~20.04.1
5.15.0-1045.52~20.04.1
ubuntu/linux-gcp-5.15<5.15.0-1039.47~20.04.1
5.15.0-1039.47~20.04.1
ubuntu/linux-hwe-5.15<5.15.0-79.86~20.04.2
5.15.0-79.86~20.04.2
ubuntu/linux-ibm-5.15<5.15.0-1036.39~20.04.1
5.15.0-1036.39~20.04.1
ubuntu/linux-intel-iotg-5.15<5.15.0-1037.42~20.04.1
5.15.0-1037.42~20.04.1
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-79.88~20.04.1
5.15.0-79.88~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1016.16~20.04.1
5.15.0-1016.16~20.04.1
ubuntu/linux-oracle-5.15<5.15.0-1040.46~20.04.1
5.15.0-1040.46~20.04.1
ubuntu/linux-riscv-5.15<5.15.0-1038.42~20.04.2
5.15.0-1038.42~20.04.2
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux<5.15.0-79.86
5.15.0-79.86
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1042.47
5.15.0-1042.47
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-azure<5.15.0-1045.52
5.15.0-1045.52
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-fde<5.15.0-1045.52.1
5.15.0-1045.52.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1039.47
5.15.0-1039.47
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gke<5.15.0-1039.44
5.15.0-1039.44
ubuntu/linux-gkeop<5.15.0-1025.30
5.15.0-1025.30
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm<5.15.0-1035.38
5.15.0-1035.38
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1037.42
5.15.0-1037.42
ubuntu/linux-kvm<5.15.0-1039.44
5.15.0-1039.44
ubuntu/linux-lowlatency<5.15.0-79.88
5.15.0-79.88
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-nvidia<5.15.0-1030.30
5.15.0-1030.30
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-tegra<5.15.0-1016.16
5.15.0-1016.16
ubuntu/linux-nvidia-tegra-igx<5.15.0-1002.2
5.15.0-1002.2
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1040.46
5.15.0-1040.46
ubuntu/linux-oracle-6.5*
ubuntu/linux-raspi<5.15.0-1035.38
5.15.0-1035.38
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1025.29
5.15.0-1025.29
ubuntu/linux-bluefield<5.15.0-1022.24
5.15.0-1022.24
ubuntu/linux-intel-iot-realtime<5.15.0-1036.38
5.15.0-1036.38
ubuntu/linux-realtime<5.15.0-1043.48
5.15.0-1043.48
ubuntu/linux-fips*
ubuntu/linux-azure-6.11*
ubuntu/linux-gcp-6.11*
ubuntu/linux-hwe-6.11*
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia-6.11*
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.8*
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1041.46~20.04.1
  2. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1045.52~20.04.1
  3. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1039.47~20.04.1
  4. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-79.86~20.04.2
  5. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1036.39~20.04.1
  6. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1037.42~20.04.1
  7. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-79.88~20.04.1
  8. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1016.16~20.04.1
  9. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1040.46~20.04.1
  10. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1038.42~20.04.2
  11. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-79.86
  12. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1042.47
  13. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1045.52
  14. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1045.52.1
  15. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1039.47
  16. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1039.44
  17. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1025.30
  18. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1035.38
  19. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1037.42
  20. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1039.44
  21. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-79.88
  22. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1030.30
  23. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1016.16
  24. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1002.2
  25. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1040.46
  26. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1035.38
  27. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1025.29
  28. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1022.24
  29. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1036.38
  30. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1043.48

Event History

Dec 30, 2025
CVE Published
via MITRE·12:08 PM
Data Sourced
via MITRE·12:08 PM
Description
Data Sourced
via OSV·01:16 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·01:16 PM
Description

Frequently Asked Questions

1

What is the severity of CVE-2023-54176?

CVE-2023-54176 has been classified as a medium severity vulnerability affecting the Linux kernel.

2

How do I fix CVE-2023-54176?

To fix CVE-2023-54176, upgrade to the latest version of the Linux kernel where the vulnerability has been addressed.

3

What systems are affected by CVE-2023-54176?

CVE-2023-54176 affects various distributions of the Linux kernel that implement the mptcp protocol.

4

What does CVE-2023-54176 affect in the mptcp protocol?

CVE-2023-54176 affects the mptcp protocol by allowing a worker to run while the relevant msk socket is in an unexpected state.

5

Who reported CVE-2023-54176?

CVE-2023-54176 was reported by a contributor named Christoph.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203