CVE-2024-40931

What it actually does

Uninitialized snd_una variable in MPTCP connect handling allows use of uninitialized memory during retransmit after fallback to regular TCP before any incoming packets are processed, enabling memory corruption.

Why it matters to the business

Linux systems relying on MPTCP face elevated risk of kernel crashes, data corruption, or remote code execution that can disrupt services and enable compromise by espionage or financially motivated actors.

How an attack unfolds

An attacker initiates an MPTCP connection that falls back to single-path TCP, then triggers a retransmit before incoming packet processing occurs so the kernel operates on the uninitialized snd_una value; this path has been reached by syzkaller and is referenced in campaigns by espionage and financially motivated actors exploiting Linux kernel uninitialized-resource issues.

How to fix it

Upgrade the Linux kernel to a version containing commit 208cd22ef5e57f82d38ec11c1a1703f9401d6dde that explicitly initializes snd_una together with snd_nxt and write_seq on connect.

How to confirm the fix worked

Confirm the fix commit is present in the kernel source tree; re-run targeted fuzzing (e.g., syzkaller) against the MPTCP fallback-retransmit sequence to verify the variable is now initialized.

Typical attack path

1. Establish MPTCP connection from attacker-controlled endpoint
2. Force fallback to regular TCP path
3. Trigger retransmission before any incoming packets are handled
4. Leverage resulting uninitialized memory access for corruption or code execution

How to detect it

Inspect kernel logs for MPTCP retransmit paths referencing uninitialized variables; correlate network traces showing rapid fallback followed by retransmit before data exchange; watch for crashes in mptcp-related functions.

What your security team should do

• Apply the referenced kernel commit or later stable release on all systems using MPTCP
• Prioritize patching internet-facing or high-value Linux servers given the low but non-zero EPSS and listed threat-actor interest
• Review kernel configuration to disable MPTCP where not required