CVE-2025-38552 (GCVE-0-2025-38552)
Vulnerability from cvelistv5
Published
2025-08-16 11:34
Modified
2025-08-28 14:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: plug races between subflow fail and subflow creation
We have races similar to the one addressed by the previous patch between
subflow failing and additional subflow creation. They are just harder to
trigger.
The solution is similar. Use a separate flag to track the condition
'socket state prevent any additional subflow creation' protected by the
fallback lock.
The socket fallback makes such flag true, and also receiving or sending
an MP_FAIL option.
The field 'allow_infinite_fallback' is now always touched under the
relevant lock, we can drop the ONCE annotation on write.
References
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Linux | Linux |
Version: 478d770008b03ed9d74bdc8add2315b7fd124ecc Version: 478d770008b03ed9d74bdc8add2315b7fd124ecc Version: 478d770008b03ed9d74bdc8add2315b7fd124ecc Version: 478d770008b03ed9d74bdc8add2315b7fd124ecc Version: 478d770008b03ed9d74bdc8add2315b7fd124ecc |
||||||
|
{ "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/mptcp/pm.c", "net/mptcp/protocol.c", "net/mptcp/protocol.h", "net/mptcp/subflow.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c476d627584b7589a134a8b48dd5c6639e4401c5", "status": "affected", "version": "478d770008b03ed9d74bdc8add2315b7fd124ecc", "versionType": "git" }, { "lessThan": "7c96d519ee15a130842a6513530b4d20acd2bfcd", "status": "affected", "version": "478d770008b03ed9d74bdc8add2315b7fd124ecc", "versionType": "git" }, { "lessThan": "f81b6fbe13c7fc413b5158cdffc6a59391a2a8db", "status": "affected", "version": "478d770008b03ed9d74bdc8add2315b7fd124ecc", "versionType": "git" }, { "lessThan": "659da22dee5ff316ba63bdaeeac7b58b5442f6c2", "status": "affected", "version": "478d770008b03ed9d74bdc8add2315b7fd124ecc", "versionType": "git" }, { "lessThan": "def5b7b2643ebba696fc60ddf675dca13f073486", "status": "affected", "version": "478d770008b03ed9d74bdc8add2315b7fd124ecc", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/mptcp/pm.c", "net/mptcp/protocol.c", "net/mptcp/protocol.h", "net/mptcp/subflow.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.15" }, { "lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.149", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.101", "versionType": "semver" }, { "lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.40", "versionType": "semver" }, { "lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.1.149", "versionStartIncluding": "5.15", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.6.101", "versionStartIncluding": "5.15", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.40", "versionStartIncluding": "5.15", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.15.8", "versionStartIncluding": "5.15", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.16", "versionStartIncluding": "5.15", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: plug races between subflow fail and subflow creation\n\nWe have races similar to the one addressed by the previous patch between\nsubflow failing and additional subflow creation. They are just harder to\ntrigger.\n\nThe solution is similar. Use a separate flag to track the condition\n\u0027socket state prevent any additional subflow creation\u0027 protected by the\nfallback lock.\n\nThe socket fallback makes such flag true, and also receiving or sending\nan MP_FAIL option.\n\nThe field \u0027allow_infinite_fallback\u0027 is now always touched under the\nrelevant lock, we can drop the ONCE annotation on write." } ], "providerMetadata": { "dateUpdated": "2025-08-28T14:43:44.872Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c476d627584b7589a134a8b48dd5c6639e4401c5" }, { "url": "https://git.kernel.org/stable/c/7c96d519ee15a130842a6513530b4d20acd2bfcd" }, { "url": "https://git.kernel.org/stable/c/f81b6fbe13c7fc413b5158cdffc6a59391a2a8db" }, { "url": "https://git.kernel.org/stable/c/659da22dee5ff316ba63bdaeeac7b58b5442f6c2" }, { "url": "https://git.kernel.org/stable/c/def5b7b2643ebba696fc60ddf675dca13f073486" } ], "title": "mptcp: plug races between subflow fail and subflow creation", "x_generator": { "engine": "bippy-1.2.0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2025-38552", "datePublished": "2025-08-16T11:34:20.455Z", "dateReserved": "2025-04-16T04:51:24.024Z", "dateUpdated": "2025-08-28T14:43:44.872Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2025-38552\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-16T12:15:31.400\",\"lastModified\":\"2025-08-28T15:15:52.797\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: plug races between subflow fail and subflow creation\\n\\nWe have races similar to the one addressed by the previous patch between\\nsubflow failing and additional subflow creation. They are just harder to\\ntrigger.\\n\\nThe solution is similar. Use a separate flag to track the condition\\n\u0027socket state prevent any additional subflow creation\u0027 protected by the\\nfallback lock.\\n\\nThe socket fallback makes such flag true, and also receiving or sending\\nan MP_FAIL option.\\n\\nThe field \u0027allow_infinite_fallback\u0027 is now always touched under the\\nrelevant lock, we can drop the ONCE annotation on write.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: conecta las ejecuciones entre el fallo y la creaci\u00f3n de un subflujo. Tenemos ejecuciones similares a la solucionada por el parche anterior entre el fallo de un subflujo y la creaci\u00f3n de subflujos adicionales. Simplemente son m\u00e1s dif\u00edciles de activar. La soluci\u00f3n es similar: se utiliza un indicador independiente para rastrear la condici\u00f3n \u00abEl estado del socket impide la creaci\u00f3n de subflujos adicionales\u00bb, protegida por el bloqueo de reserva. El bloqueo de reserva del socket hace que dicho indicador sea verdadero, y tambi\u00e9n se recibe o env\u00eda una opci\u00f3n MP_FAIL. El campo \u00aballow_infinite_fallback\u00bb ahora siempre se activa bajo el bloqueo correspondiente; podemos omitir la anotaci\u00f3n ONCE al escribir.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/659da22dee5ff316ba63bdaeeac7b58b5442f6c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7c96d519ee15a130842a6513530b4d20acd2bfcd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c476d627584b7589a134a8b48dd5c6639e4401c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/def5b7b2643ebba696fc60ddf675dca13f073486\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f81b6fbe13c7fc413b5158cdffc6a59391a2a8db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…