Skip to content
Heist/ feed
Critical

mptcp: consolidate suboption status

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: mptcp: consolidate suboption status MPTCP maintains the received sub-options status is the bitmask carrying the received suboptions and in several bitfields carrying per suboption additional info. Zeroing the bitmask before parsing is not enough to ensure a consistent status, and the MPTCP code has to additionally clear some bitfiled depending on the actually parsed suboption. The above schema is fragile, and syzbot managed to trigger a path where a relevant bitfield is not cleared/initialized: BUG: KMSAN: uninit-value in __mptcp_expand_seq net/mptcp/options.c:1030 [inline] BUG: KMSAN: uninit-value in mptcp_expand_seq net/mptcp/protocol.h:864 [inline] BUG: KMSAN: uninit-value in ack_update_msk net/mptcp/options.c:1060 [inline] BUG: KMSAN: uninit-value in mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209 __mptcp_expand_seq net/mptcp/options.c:1030 [inline] mptcp_expand_seq net/mptcp/protocol.h:864 [inline] ack_update_msk net/mptcp/options.c:1060 [inline] mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209 tcp_data_queue+0xb4/0x7be0 net/ipv4/tcp_input.c:5233 tcp_rcv_established+0x1061/0x2510 net/ipv4/tcp_input.c:6264 tcp_v4_do_rcv+0x7f3/0x11a0 net/ipv4/tcp_ipv4.c:1916 tcp_v4_rcv+0x51df/0x5750 net/ipv4/tcp_ipv4.c:2351 ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_loca

Announced Source revision 1
Original source ↗

CVE-2025-21707

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-21707

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc",
        "lessThan": "3a7fda57b0f91f7ea34476b165f91a92feb17c96",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc",
        "lessThan": "3b5332d416d151a15742d1b16e7319368e3cc5c6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc",
        "lessThan": "7f6c72b8ef8130760710e337dc8fbe7263954884",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc",
        "lessThan": "6169e942370b4b6f9442d35c51519bf6c346843b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc",
        "lessThan": "ba0518f9e8688cd4fcb569e8df2a74874b4f3894",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc",
        "lessThan": "c86b000782daba926c627d2fa00c3f60a75e7472",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/mptcp/options.c",
      "net/mptcp/protocol.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.11"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.11",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.179",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.129",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.76",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.13",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.13.2",
        "versionType": "semver",
        "lessThanOrEqual": "6.13.*"
      },
      {
        "status": "unaffected",
        "version": "6.14",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/mptcp/options.c",
      "net/mptcp/protocol.h"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-21707

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#26915 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement