mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().
In the Linux kernel, the following vulnerability has been resolved: mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0] We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0"). Let's apply the same fix to mptcp_do_fastclose(). [0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: tcp_select_window net/ipv4
CVE-2025-68291
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-68291
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9ea05fabce31ff93a0adae8221c58bc6d7b832f3",
"lessThan": "46b8b58f93f1b383c3840fc6e8fab6c3bce9295f",
"versionType": "git"
},
{
"status": "affected",
"version": "3a13454fd098ed51e733958488f8ec62859a9ed8",
"lessThan": "eee39f83246a81d970a9ecb7392b7ab74e660094",
"versionType": "git"
},
{
"status": "affected",
"version": "f6fb2cbc91a81178dea23d463503b4525a76825d",
"lessThan": "05f5e26d488cdc7abc2a826cf1071782d5a21203",
"versionType": "git"
},
{
"status": "affected",
"version": "c4f7b0916b95fd2226e5ab98882482b08f52e1c0",
"lessThan": "88163f85d59b4164884df900ee171720fd26686b",
"versionType": "git"
},
{
"status": "affected",
"version": "ae155060247be8dcae3802a95bd1bdf93ab3215d",
"lessThan": "f07f4ea53e22429c84b20832fa098b5ecc0d4e35",
"versionType": "git"
}
],
"programFiles": [
"net/mptcp/protocol.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1.159",
"lessThan": "6.1.160",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.119",
"lessThan": "6.6.120",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.60",
"lessThan": "6.12.61",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.17.10",
"lessThan": "6.17.11",
"versionType": "semver"
}
],
"programFiles": [
"net/mptcp/protocol.c"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2025-68291
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #27117 · Revision 1
- Added to Heist Feed
- Publisher date