CVE-2024-26708

CVE-2024-26708 affects the Linux kernel MPTCP subsystem. Description in provided docs: fastopen race between Fastopen and PM-trigger subflow shutdown can race; initial patch missed a state change before subflow_state_change callback. The fix copies all states reachable from TCP_FIN_WAIT1 to handl...

kernel: Linux kernel: Denial of Service due to NULL pointer dereference in mptcp fastopen

A flaw was found in the Linux kernel's Multipath TCP mptcp implementation. During an early fallback to TCP in the fastopen process, the system incorrectly deletes a subflow context before it is no longer needed. This can lead to a NULL pointer dereference, allowing a local attacker with low...

kernel: tcp: Fix data-races around sysctl_tcp_fastopen.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctltcpfastopen. While reading sysctltcpfastopen, it can be changed concurrently. Thus, we need to add READONCE to its readers...

kernel: tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctltcpfastopenblackholetimeout. While reading sysctltcpfastopenblackholetimeout, it can be changed concurrently. Thus, we need to add READONCE to its readers...

PT-2025-8518 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A data-race issue exists in the Linux kernel related to the sysctl tcp fastopen blackhole timeout variable. This issue occurs because the variable can be changed concurrently while bei...

PT-2025-8519 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A data-race issue exists around sysctl tcp fastopen in the Linux kernel. The value of sysctl tcp fastopen can be changed concurrently while it is being read, which requires the use of...

kernel: a BUG() statement can be hit in net/ipv4/tcp_input.c

It was discovered that the Linux kernel since 3.6-rc1 with 'net.ipv4.tcpfastopen' set to 1 can hit BUG statement in tcpcollapse function after making a number of certain syscalls leading to a possible system crash...

kernel: a BUG() statement can be hit in net/ipv4/tcp_input.c

It was discovered that the Linux kernel since 3.6-rc1 with 'net.ipv4.tcpfastopen' set to 1 can hit BUG statement in tcpcollapse function after making a number of certain syscalls leading to a possible system crash...