Skip to content
Heist/ feed
High

mptcp: avoid deadlock on fallback while reinjecting

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid deadlock on fallback while reinjecting Jakub reported an MPTCP deadlock at fallback time: WARNING: possible recursive locking detected 6.18.0-rc7-virtme #1 Not tainted -------------------------------------------- mptcp_connect/20858 is trying to acquire lock: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_try_fallback+0xd8/0x280 but task is already holding lock: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&msk->fallback_lock); lock(&msk->fallback_lock); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by mptcp_connect/20858: #0: ff1100001da18290 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0x114/0x1bc0 #1: ff1100001db40fd0 (k-sk_lock-AF_INET#2){+.+.}-{0:0}, at: __mptcp_retrans+0x2cb/0xaa0 #2: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0 stack backtrace: CPU: 0 UID: 0 PID: 20858 Comm: mptcp_connect Not tainted 6.18.0-rc7-virtme #1 PREEMPT(full) Hardware name: Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack_lvl+0x6f/0xa0 print_deadlock_bug.cold+0xc0/0xcd validate_chain+0x2ff/0x5f0 __lock_acquire+0x34c/0x740 lock_acquire.part.0+0xbc/0x260 _raw_spin_lock_bh+0x38/0x50 __mptcp_try_fallback+0xd8/0x280 mptcp_sendmsg_frag+0x16c2/0x3050 __mptcp_retrans+0x421/0xaa0 mptcp_release_cb+0x5aa/0xa

Announced Source revision 1
Original source ↗

CVE-2025-71126

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-71126

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5586518bec27666c747cd52aabb62d485686d0bf",
        "lessThan": "0107442e82c0f8d6010e07e6030741c59c520d6e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "75a4c9ab8a7af0d76b31ccd1188ed178c38b35d2",
        "lessThan": "252892d5a6a2f163ce18f32716e46fa4da7d4e79",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "54999dea879fecb761225e28f274b40662918c30",
        "lessThan": "0ca9fb4335e726dab4f23b3bfe87271d8f005f41",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f8a1d9b18c5efc76784f5a326e905f641f839894",
        "lessThan": "50f47c02be419bf0a3ae94c118addf67beef359f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f8a1d9b18c5efc76784f5a326e905f641f839894",
        "lessThan": "ffb8c27b0539dd90262d1021488e7817fae57c42",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1d82a8fe6ee4afdc92f4e8808c9dad2a6095bbc5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6.1.149",
        "lessThan": "6.1.160",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.6.101",
        "lessThan": "6.6.120",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.12.40",
        "lessThan": "6.12.64",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.15.8",
        "lessThan": "6.16",
        "versionType": "semver"
      }
    ],
    "programFiles": [
      "net/mptcp/protocol.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.16"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.16",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.120",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.64",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.3",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/mptcp/protocol.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-71126

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#39165 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement