CVE-2021-47132

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix skforwardmemory corruption on retransmission MPTCP skforwardmemory handling is a bit special, as such field is protected by the msk socket spinlock, instead of the plain socket lock. Currently we have a code path...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a possible corruption of the skforwardmemory method of the mptcp module during retransmissions...

CVE-2021-47132: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix skforwardmemory corruption on retransmission MPTCP skforwardmemory handling is a bit special, as such field is protected by the msk socket spinlock, instead of the plain socket lock. Currently we have a code path...

PT-2024-3410

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.8.0-rc1+ Description: The vulnerability is related to a double-free issue in the Linux kernel's MPTCP Multipath TCP implementation. When an MPTCP server accepts an incoming connection, it clones its listener...

PT-2024-8426

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a data race condition in the mptcp component of the Linux kernel, which can be exploited to manipulate data. The vulnerability is associated with the remote id an...

PT-2024-7293

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a race condition in the mptcp component of the Linux kernel, where Fastopen and PM-trigger subflow shutdown can race, as reported by syzkaller. The subflow stat...

PT-2024-7713

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the MPTCP Multipath TCP component in the Linux kernel. When the MPTCP PM detects that a subflow is stale, the packet scheduler must re-inject all the mptcp-level...

PT-2024-8467

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to errors in resource management within the subflow finish connect function of the mptcp component in the Linux kernel. This may allow an attacker to cause a denial ...

PT-2024-14741

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.0-rc5-gcd8bdf563d46 Description The issue arises from the TCP sockets and MPTCP subflows building egress packets larger than 64K, exceeding the maximum DSS data size. This results in the length being...

PT-2025-40197

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.5.0-rc1-gdc7b257ee5dd Description The Linux kernel’s mptcp protocol was susceptible to a race condition between disconnect or shutdown and accept operations. This issue stemmed from an incomplete fix in a...

kernel: mptcp: NULL pointer dereference in subflow traversal at disconnect time

A NULL pointer dereference issue was discovered in the Linux kernel. This issue occurs in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could potentially crash the system, causing a denial of service...

PT-2025-18852

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fixed version Description A use-after-free issue was found in the mptcp listener shutdown path in the Linux kernel. This issue can occur when the msk grace period expires between the last reference count drop...

PT-2025-18836

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 Description A use-after-free UaF issue was reported in the Linux kernel, specifically in the mptcp module, at token lookup time after refactoring the passive sock...

PT-2023-36771

Уязвимость функции mptcp close ssk и mptcp worker модуля net/mptcp/protocol.c ядра операционной системы Linux связана с некорректной инициализацией. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...

PT-2023-36770

Уязвимость функции mptcp close ssk модуля net/mptcp/protocol.c ядра операционной системы Linux связана с ошибками при обновлении счетчика ссылок. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...

K43470422: BIG-IP MPTCP vulnerability CVE-2021-23003

Security Advisory Description The Traffic Management Microkernel TMM process may produce a core file when undisclosed MPTCP traffic passes through a standard virtual server. CVE-2021-23003 Impact A remote attacker may be able to cause the BIG-IP system to produce a core file, disrupting the flow ...

K31025212: BIG-IP MPTCP vulnerability CVE-2021-23004

Security Advisory Description Multipath TCP MPTCP forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. CVE-2021-23004 Impact A remote attacker may be able to cause a BIG-IP system to consume excessive system resources and produce a core fil...

K16248201: TMM vulnerability CVE-2018-15318

Security Advisory Description If an MPTCP connection receives an abort signal while the initial flow is not the primary flow, the initial flow will remain after the closing procedure is complete. TMM may restart and produce a core file as a result of this condition. CVE-2018-15318 Impact The BIG-...

SUSE CVE-2017-13040

The MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions...

Unbreakable Enterprise kernel security update

5.15.0-7.86.6.1 - net/rds: Delegate fan-out to a background worker Gerd Rausch Orabug: 35051226 5.15.0-7.86.6 - runtime revert of virtionet: Stripe queue affinities across cores. Konrad Rzeszutek Wilk Orabug: 35001044 - rds: ib: Make sure messages that errors out also get unmapped Hakon Bugge...