CVE-2024-46858

What it actually does

Race condition between net_rx_action path and netlink path allows concurrent access to mptcp_pm_del_add_timer, resulting in use-after-free when an entry is freed outside the pm.lock after remove_anno_list_by_saddr and then dereferenced in mptcp_pm_del_add_timer.

Why it matters to the business

Linux systems using MPTCP may experience kernel crashes, memory corruption, or potential local privilege escalation under concurrent address management and network traffic, increasing operational risk and requiring urgent patching on affected kernels.

How an attack unfolds

An attacker with local access or the ability to influence network traffic and netlink operations triggers concurrent execution of tcp_data_queue handling and mptcp_pm_nl_flush_addrs_doit, racing the timer deletion and list removal to trigger the UAF in the timer path.

How to fix it

Update the Linux kernel to a version containing commit 0e7814b028cd50b3ff79659d23dfa9da6a1e75e1 or later stable releases that keep a reference under the pm.lock and move list_del inside the lock; apply vendor backports for all supported branches.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source tree, confirm that mptcp_pm_del_add_timer no longer accesses entry members outside the pm.lock, and test concurrent address flush and data receive workloads for absence of UAF reports.

Typical attack path

1. Establish MPTCP connection with address announcements
2. Trigger netlink address flush via mptcp_pm_nl_flush_addrs_doit on one CPU
3. Simultaneously receive TCP data that invokes mptcp_incoming_options and mptcp_pm_del_add_timer on another CPU
4. Free the timer entry outside the lock and dereference it to trigger UAF

How to detect it

Inspect kernel logs for use-after-free warnings or slab corruption involving mptcp_pm structures during concurrent MPTCP address operations; review netlink and TCP receive traces for overlapping flush and data paths around the time of any crash.

What your security team should do

• Prioritize kernel upgrades on all MPTCP-enabled systems within the next maintenance window
• Monitor for new stable releases containing the referenced commit
• Restrict unprivileged netlink access where MPTCP is active until patched
• Review downstream dependent packages for any required rebuilds