CVE-2022-48906

What it actually does

Large DATA_FIN retransmit counts trigger a shift-out-of-bounds in mptcp_set_datafin_timeout (net/mptcp/protocol.c:470) when computing timeout values, producing a UBSAN-detected error and potential undefined behavior or kernel instability during MPTCP retransmission handling.

Why it matters to the business

Systems using MPTCP may experience kernel panics or service disruption under sustained retransmit conditions, increasing downtime risk for network-dependent workloads; the issue affects the upstream Linux kernel with a patch available since August 2024.

How an attack unfolds

An attacker establishes an MPTCP connection and induces repeated DATA_FIN retransmissions (for example via packet loss or crafted traffic), causing the retransmit counter to grow large enough to overflow the shift calculation and trigger the out-of-bounds error in the kernel worker thread.

How to fix it

Upgrade the Linux kernel to commit 62fb9874f5da54fdb243003b386128037319b219 or later; apply the corresponding stable or distribution backport that limits the shift size in mptcp_set_datafin_timeout.

How to confirm the fix worked

Confirm the running kernel contains commit 62fb9874f5da54fdb243003b386128037319b219; recompile or boot with UBSAN enabled and verify no shift-out-of-bounds reports occur under high-retransmit MPTCP test scenarios.

Typical attack path

1. Establish MPTCP connection to target
2. Induce repeated DATA_FIN retransmissions through network manipulation
3. Drive retransmit count beyond 32 to trigger shift overflow
4. Cause kernel UBSAN fault or instability in mptcp_worker

How to detect it

Review kernel logs for UBSAN shift-out-of-bounds messages referencing net/mptcp/protocol.c:470 or mptcp_set_datafin_timeout; inspect MPTCP connection statistics and retransmit counters for anomalous spikes preceding any crash.

What your security team should do

• Prioritize kernel upgrades on systems exposing MPTCP (port 0 or well-known MPTCP ports) within normal patch cycles
• Monitor upstream stable branches for the backported fix and schedule deployment
• Test MPTCP workloads after upgrade to confirm retransmission handling stability