CVE-2021-47152

What it actually does

The mptcp_frag_can_collapse_to() function incorrectly assumes exclusive ownership of page_frag allocations, allowing plain TCP to allocate fragments that MPTCP later reuses for mptcp_data_frag structures and thereby corrupting the data stream.

Why it matters to the business

Systems relying on MPTCP may experience silent data corruption on inbound connections, leading to application failures, unreliable network sessions, and potential loss of data integrity in multipath TCP deployments.

How an attack unfolds

An attacker configures a transparent proxy to force MPTCP on TCP connections; when plain TCP allocates a page fragment and MPTCP subsequently collapses its own fragment onto the same memory, data written by one protocol overwrites the other, corrupting the stream.

How to fix it

Upgrade the Linux kernel to a version containing the fix that checks the data fragment is located at the current page_frag end before allowing collapse.

How to confirm the fix worked

Confirm the running kernel contains the upstream commit that adds the end-of-page_frag check; reproduce the reported transparent-proxy scenario and verify absence of data corruption.

Typical attack path

1. Position a transparent proxy to intercept and convert inbound TCP flows to MPTCP
2. Trigger page_frag allocation via ordinary TCP traffic
3. Invoke mptcp_frag_can_collapse_to() on an overlapping fragment
4. Cause reuse of already-written memory for mptcp_data_frag
5. Observe or leverage resulting stream corruption

How to detect it

Review kernel ring buffer and MPTCP debug logs for unexpected fragment reuse warnings; inspect network captures for checksum or sequence anomalies on MPTCP subflows after proxy interactions.

What your security team should do

• Apply the kernel patch or distribution update that resolves the page_frag reuse condition
• Audit configurations that enable MPTCP on systems also using transparent proxies or mixed TCP/MPTCP workloads
• Include MPTCP-related memory handling in future kernel regression test suites