MPTCP Vulnerability in Linux Kernel Affects Network Performance

CVE-2025-21707

Summary

A vulnerability has been identified in the MPTCP implementation within the Linux kernel, wherein the handling of received suboptions status is not robust enough. The current mechanism relies on a bitmask to manage the state of these suboptions, but fails to consistently clear certain associated bitfields during parsing. This lapse can lead to undefined behavior, potentially exposing systems to various network attacks. The flaw has been demonstrated by tools like syzbot, which triggered scenarios where crucial bitfields remained uninitialized, thereby creating pathways for exploitation.

References