CVE-2024-26708

What it actually does

Race condition in MPTCP Fastopen handling allows subflow status changes between shutdown trigger and subflow_state_change callback, leaving connections in inconsistent states reachable from TCP_FIN_WAIT1.

Why it matters to the business

Unpatched systems may experience connection instability or crashes during high-speed or multi-path TCP sessions, disrupting services that rely on reliable network connectivity and requiring urgent patching to avoid downtime.

How an attack unfolds

An attacker crafts network traffic or uses fuzzing techniques to trigger concurrent Fastopen and path-manager subflow shutdown events, racing the state machine before the callback fires and potentially causing kernel-level mishandling.

How to fix it

Update onlyoffice/documentserver (GIT) to commit 0187bea803abdd2b2b6ad8168272d77e27739add or later; apply the kernel patch that fully handles all states reachable from TCP_FIN_WAIT1.

How to confirm the fix worked

Confirm the deployed kernel or documentserver build contains commit 0187bea803abdd2b2b6ad8168272d77e27739add; run targeted MPTCP Fastopen shutdown stress tests to verify no races remain.

Typical attack path

1. Establish MPTCP connection with Fastopen enabled
2. Trigger concurrent PM-driven subflow shutdown while Fastopen processing is active
3. Force subflow status mutation before subflow_state_change callback executes
4. Reach inconsistent states from TCP_FIN_WAIT1 causing resource leaks or crashes

How to detect it

Review kernel logs for MPTCP subflow state warnings or crashes during Fastopen usage; correlate with network traces showing concurrent subflow shutdowns; no public exploitation artifacts known.

What your security team should do

• Prioritize upgrade of onlyoffice/documentserver to the listed fixed commit within standard change windows
• Monitor upstream Linux MPTCP patches for backports if custom kernels are in use
• Add regression tests covering Fastopen and subflow shutdown races to CI pipelines