Linux Kernel MPTCP NULL Pointer Dereference Vulnerability in Fast Open Early Fallback

A vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation can lead to a NULL pointer dereference. This issue occurs in the fast open path when there is an early fallback to TCP. The subflow_syn_recv_sock() function deletes the subflow context before returning a newly allocated socket, and the fast open path does not handle this properly, leading to an unconditioned dereference.

Impact

Exploitation of this vulnerability causes a NULL pointer dereference, which typically leads to a crash of the affected component or process.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.