CVE-2024-35894

What it actually does

BPF programs can invoke MPTCP-level proto_ops operations from a TCP subflow socket context, allowing unauthorized access to MPTCP receive lowat settings and triggering kernel warnings during setsockopt calls.

Why it matters to the business

Systems relying on MPTCP combined with BPF socket operations may experience kernel warnings or unexpected networking behavior; the issue affects Linux kernels prior to 6.8.5 and requires prompt patching to avoid operational disruptions in high-availability or containerized environments.

How an attack unfolds

An attacker with local access loads or attaches a BPF program that performs setsockopt operations on an MPTCP socket; the program reaches tcp_connect paths that invoke subflow_data_ready, bypassing intended scope checks and triggering the mptcp_set_rcvlowat call on a subflow.

How to fix it

Upgrade the Linux kernel to version 6.8.5 or apply commit ee3c845787b621cfe82c2e52c513024a9d7a78f5 in the stable tree; rebuild and reboot affected systems, then verify MPTCP and BPF functionality post-upgrade.

How to confirm the fix worked

Confirm the running kernel version is 6.8.5 or newer; test with BPF programs that previously triggered subflow setsockopt calls to ensure the warning no longer occurs; review kernel build logs for the applied fix.

Typical attack path

1. Compile or load a BPF program that calls bpf_sock_ops_setsockopt on MPTCP connections
2. Trigger socket connection setup via inet_stream_connect or tcp_v6_connect
3. Invoke cgroup BPF filters that run the sock_ops program during connect
4. Cause subflow_data_ready to be called with mismatched proto_ops leading to the warning

How to detect it

Search kernel logs and dmesg for the exact warning string from subflow.c:1430 during BPF sockopt activity; inspect audit logs for unusual BPF program loads involving socket operations on MPTCP-enabled connections.

• WARNING: CPU:.*at net/mptcp/subflow.c:1430 subflow_data_ready
• mptcp_set_rcvlowat+0x79/0x1d0
• bpf_sock_ops_setsockopt+0x3c/0x90

What your security team should do

• Prioritize kernel upgrades on all systems using MPTCP and custom BPF socket programs
• Monitor for the specific subflow.c warning in dmesg or syslog as an indicator of exposure
• Restrict untrusted BPF program loading via kernel lockdown or LSM policies until patched
• Validate downstream package updates from distributions that include the fix