CVE-2024-53122

What it actually does

Race condition in MPTCP subflow list handling allows recvmsg() to invoke tcp_cleanup_rbuf() on newly created subflows that have not completed their 3-way handshake, triggering a divide-by-zero error.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes or denial of service, disrupting network services and requiring reboots; urgency is moderate given low EPSS and lack of known exploitation despite listed threat actor mentions.

How an attack unfolds

An attacker with local access races creation of an active subflow by the in-kernel path manager against a concurrent recvmsg() call that iterates all subflows and calls tcp_cleanup_rbuf() without state checks, causing the divide-by-zero on the incomplete subflow.

How to fix it

Apply the upstream fix that adds an explicit subflow state check before calling tcp_cleanup_rbuf(); for listed Ubuntu packages upgrade to the referenced fixed versions such as gdb 7.7.1-0ubuntu5~14.04.3 or 7.11.1-0ubuntu1~16.5, libiberty 20131116-1ubuntu0.2, and valgrind 1:3.10.1-1ubuntu3~14.5.

How to confirm the fix worked

Confirm kernel or package versions match the fixed releases; review MPTCP subflow creation paths for the added state guard; test concurrent recvmsg() and subflow addition workloads for absence of divide-by-zero faults.

Typical attack path

1. Obtain local code execution on a system using MPTCP
2. Trigger in-kernel path manager to create additional active subflows
3. Concurrently issue recvmsg() on an established subflow to iterate the subflow list
4. Hit the unconditional tcp_cleanup_rbuf() call on a subflow still initializing its 3-way handshake
5. Trigger divide-by-zero and resulting kernel fault

How to detect it

Search kernel logs for divide-by-zero oops messages involving mptcp_rcv_space_adjust or tcp_cleanup_rbuf; inspect audit and syscall logs for unusual concurrent recvmsg() and MPTCP subflow activity; correlate with process creation of local unprivileged users.

What your security team should do

• Prioritize patching systems that enable MPTCP in production
• Monitor for local privilege or availability abuse on multi-homed hosts
• Apply the exact fixed package versions provided for Ubuntu 14.04 and 16.04 environments
• Review any downstream dependents for similar MPTCP usage patterns