Linux Kernel TCP CDG Congestion Control Double-Free Vulnerability

A double-free vulnerability has been identified in the Linux kernel's TCP congestion control, specifically within the CDG (Congestion Detection General) algorithm. This issue arises when MPTCP (Multipath TCP) calls tcp_disconnect() on a flow that has already been disconnected. While this behavior is generally acceptable, it creates a problem for flows using the CDG congestion control, potentially leading to a double-free error. The vulnerability has been addressed by allowing tcp_cdg_release() to be called multiple times, making the tcp_disconnect() function more resilient.

Impact

Exploitation of this vulnerability could lead to a double-free error, causing memory corruption issues.