CVE-2022-4128

What it actually does

NULL pointer dereference in the Linux kernel MPTCP implementation during subflow list traversal at disconnect time, resulting in a kernel panic and denial of service.

Why it matters to the business

Local users can intentionally or accidentally crash affected Linux systems, causing unplanned downtime and loss of availability for any workloads running on those hosts.

How an attack unfolds

A local attacker establishes an MPTCP connection and then triggers a disconnect sequence that forces the kernel to walk a subflow list containing a NULL entry, dereferencing the pointer and crashing the system.

How to fix it

Upgrade the Linux kernel to a version containing commit 5c835bb142d4 or later; apply the fix via distribution package updates or rebuild from the patched source.

How to confirm the fix worked

Confirm the running kernel contains commit 5c835bb142d4 or a backported equivalent; test MPTCP disconnect paths in a lab environment to verify stability.

Typical attack path

1. Obtain local shell access on a vulnerable Linux host
2. Create an MPTCP socket and establish multiple subflows
3. Trigger the disconnect path while the subflow list state is malformed
4. Kernel panics due to NULL dereference

How to detect it

Review kernel logs for oops or panic messages referencing MPTCP or subflow list traversal around the time of unexpected reboots or hangs.

What your security team should do

• Prioritize kernel updates on all internet-facing or multi-tenant Linux systems
• Restrict local user access where possible until patches are applied
• Monitor for kernel oops/panic reports mentioning MPTCP