Linux Kernel MPTCP Unaccepted Socket Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's implementation of Multipath TCP (MPTCP). This issue arises when a listener socket is closed, freeing unaccepted subflows and leading to the deletion of paired MPTCP sockets. If the MPTCP socket's worker accesses the 'first' field of the MPTCP socket during this interval, it can cause a use-after-free condition, as the subflow cleanup does not clear that field. The vulnerability has been addressed by explicitly traversing the listener socket's accept queue at close time and performing the necessary cleanup on pending MPTCP sockets, although this requires careful management of socket locks.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, potentially allowing for arbitrary code execution or memory corruption.