Linux Kernel MPTCP TOCTOU Race Condition Vulnerability in Window Management

A time-of-check to time-of-use (TOCTOU) race condition vulnerability has been identified in the Linux kernel's Multipath TCP (MPTCP) implementation. This issue arises because the MPTCP output path accesses the MPTCP-level acknowledgment sequence multiple times without proper locking, potentially leading to inconsistencies. The vulnerability affects the announced receive window for the same packet, which could confuse the peer. The issue has been addressed by refactoring the code to ensure that the MPTCP receive window is updated only when the egress packet contains a Data-Synchronization Service (DSS) acknowledgment.

Impact

The vulnerability could lead to inconsistencies in the MPTCP acknowledgment sequence and receive window management, potentially confusing the peer and disrupting the TCP flow control.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.