Linux Kernel MPTCP Listener Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's implementation of Multipath TCP (MPTCP) listeners. This issue arises during the shutdown process of listener sockets, where a reference to a socket can be improperly released, leading to potential memory corruption. The vulnerability was introduced after a refactor of the passive socket initialization, which inadvertently created a race condition. As a result, the MPTCP worker may access a socket that has already been freed, causing undefined behavior.

Impact

Exploitation of this vulnerability can lead to memory corruption, which may be leveraged to execute arbitrary code or cause a denial-of-service condition by crashing the system.