mptcp: use the workqueue to destroy unaccepted sockets

{
  "id": "a64abd53684aeba5177ebbbe0ef15782382e5affee65058b984f9a7d4141fca6",
  "url": "https://osv.dev/vulnerability/CVE-2023-53072",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "mptcp: use the workqueue to destroy unaccepted sockets",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: mptcp: use the workqueue to destroy unaccepted sockets Christoph reported a UaF at token lookup time after having refactored the passive socket initialization part: BUG: KASAN: use-after-free in __token_bucket_busy+0x253/0x260 Read of size 4 at addr ffff88810698d5b0 by task syz-executor653/3198 CPU: 1 PID: 3198 Comm: syz-executor653 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x6e/0x91 print_report+0x16a/0x46f kasan_report+0xad/0x130 __token_bucket_busy+0x253/0x260 mptcp_token_new_connect+0x13d/0x490 mptcp_connect+0x4ed/0x860 __inet_stream_connect+0x80e/0xd90 tcp_sendmsg_fastopen+0x3ce/0x710 mptcp_sendmsg+0xff1/0x1a20 inet_sendmsg+0x11d/0x140 __sys_sendto+0x405/0x490 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc We need to properly clean-up all the paired MPTCP-level resources and be sure to release the msk last, even when the unaccepted subflow is destroyed by the TCP internals via inet_child_forget(). We can re-use the existing MPTCP_WORK_CLOSE_SUBFLOW infra, explicitly checking that for the critical scenario: the closed subflow is the MPC one, the msk is not accepted and eventually going through full cleanup. With such change, __mptcp_destroy_sock() is always called on msk sockets, even on accepted ",
    "evidence": "osv:CVE-2023-53072",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.22",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.2.8",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2023-53072",
      "aliases": [
        "CVE-2023-53072"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "58b09919626bf9067345289212ec030c61eb1034"
                },
                {
                  "fixed": "2827f099b3fb9a59263c997400e9182f5d423e84"
                },
                {
                  "fixed": "804cf487fb0031f3c74755b78d8663333f0ba636"
                },
                {
                  "fixed": "b6985b9b82954caa53f862d6059d06c0526254f0"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53072.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.7.0"
                },
                {
                  "fixed": "6.1.22"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.2.8"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53072.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.444443567Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/2827f099b3fb9a59263c997400e9182f5d423e84",
        "https://git.kernel.org/stable/c/804cf487fb0031f3c74755b78d8663333f0ba636",
        "https://git.kernel.org/stable/c/b6985b9b82954caa53f862d6059d06c0526254f0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53072.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-53072",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53072.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-53072",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 504550,
  "published_at": "2025-05-02T15:55:23.765+00:00"
}