CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation
In the Linux kernel, the following vulnerability has been resolved:
mptcp: plug races between subflow fail and subflow creation
We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger.
The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock.
The socket fallback makes such flag true, and also receiving or sending an MPFAIL option.
The field 'allowinfinitefallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38552?
CVE-2025-38552 has been classified with a severity level indicating potential impacts on system security and stability.
How do I fix CVE-2025-38552?
To address CVE-2025-38552, users should update to the latest stable version of the Linux kernel that includes the patch.
What impact does CVE-2025-38552 have on system performance?
CVE-2025-38552 may lead to performance degradation under certain race conditions in the mptcp functionality.
Is CVE-2025-38552 exploitable remotely?
CVE-2025-38552 may be exploitable remotely given its nature related to the mptcp protocol.
What versions of Linux Kernel are affected by CVE-2025-38552?
CVE-2025-38552 affects multiple versions of the Linux Kernel that use the mptcp capability.