CVE-2025-21705
NoneCVSS
—
EPSS
0.2%
Published
Feb 27, 2025
CISA due date
—
Cloudanix analysis
A flaw in how the Linux kernel manages certain network connections could cause crashes or corrupted data on servers and devices until the operating system is updated.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Data Tampering
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Improper handling of internal disconnect events during MPTCP fastopen connect errors allows concurrent threads to observe inconsistent socket state, triggering data stream corruption detected by __mptcp_clean_una.
Why it matters to the business
Systems running affected kernels may experience unexpected crashes or corrupted network data transfers when applications use MPTCP fastopen, increasing operational risk and potential downtime on servers and cloud instances until patched.
How an attack unfolds
An attacker triggers an MPTCP fastopen connect error path that generates an internal disconnect without incrementing the socket disconnect counter, allowing a competing thread to bypass error handling and corrupt send buffers; the flaw was originally found via fuzzing and has been referenced alongside other kernel privilege-escalation techniques in public threat reporting.
How to fix it
Upgrade Linux kernel to version 6.1.129 or later, or apply commit 73e268b4be27b36ae68ea10755cb003f43b38884 in the stable tree; rebuild and reboot systems using the fixed kernel.
How to confirm the fix worked
Confirm the running kernel version is at least 6.1.129 or contains commit 73e268b4be27b36ae68ea10755cb003f43b38884; attempt to reproduce the original syzbot reproducer to verify the warning no longer triggers.
Typical attack path
- Establish an MPTCP socket and initiate a fastopen sendmsg that encounters a connect error
- Force an internal disconnect generated by the protocol stack without proper counter update
- Race another thread holding the socket lock to observe stale state
- Trigger __mptcp_clean_una to hit the corruption warning or data inconsistency
How to detect it
Search kernel logs for the exact __mptcp_clean_una warning string and stack trace involving mptcp_sendmsg_fastopen; inspect system call traces for rapid sendmsg failures on MPTCP sockets.
What your security team should do
- Prioritize patching all production kernels to the fixed versions within the next maintenance window
- Monitor kernel update channels for backports to older LTS branches still in use
- Review any custom MPTCP fastopen usage in applications for additional hardening opportunities
The record
In the Linux kernel, the following vulnerability has been resolved: mptcp: handle fastopen disconnect correctly Syzbot was able to trigger a data stream corruption: WARNING: CPU: 0 PID: 9846 at net/mptcp/protocol.c:1024 __mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024 Modules linked in: CPU: 0 UID: 0 PID: 9846 Comm: syz-executor351 Not tainted 6.13.0-rc2-syzkaller-00059-g00a5acdbf398 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 RIP: 0010:__mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024 Code: fa ff ff 48 8b 4c 24 18 80 e1 07 fe c1 38 c1 0f 8c 8e fa ff ff 48 8b 7c 24 18 e8 e0 db 54 f6 e9 7f fa ff ff e8 e6 80 ee f5 90 <0f> 0b 90 4c 8b 6c 24 40 4d 89 f4 e9 04 f5 ff ff 44 89 f1 80 e1 07 RSP: 0018:ffffc9000c0cf400 EFLAGS: 00010293 RAX: ffffffff8bb0dd5a RBX: ffff888033f5d230 RCX: ffff888059ce8000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000c0cf518 R08: ffffffff8bb0d1dd R09: 1ffff110170c8928 R10: dffffc0000000000 R11: ffffed10170c8929 R12: 0000000000000000 R13: ffff888033f5d220 R14: dffffc0000000000 R15: ffff8880592b8000 FS: 00007f6e866496c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6e86f491a0 CR3: 00000000310e6000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __mptcp_clean_una_wakeup+0x7f/0x2d0 net/mptcp/protocol.c:1074 mptcp_release_cb+0x7cb/0xb30 net/mptcp/protocol.c:3493 release_sock+0x1aa/0x1f0 net/core/sock.c:3640 inet_wait_for_connect net/ipv4/af_inet.c:609 [inline] __inet_stream_connect+0x8bd/0xf30 net/ipv4/af_inet.c:703 mptcp_sendmsg_fastopen+0x2a2/0x530 net/mptcp/protocol.c:1755 mptcp_sendmsg+0x1884/0x1b10 net/mptcp/protocol.c:1830 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:726 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583 ___sys_sendmsg net/socket.c:2637 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6e86ebfe69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6e86649168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f6e86f491b8 RCX: 00007f6e86ebfe69 RDX: 0000000030004001 RSI: 0000000020000080 RDI: 0000000000000003 RBP: 00007f6e86f491b0 R08: 00007f6e866496c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6e86f491bc R13: 000000000000006e R14: 00007ffe445d9420 R15: 00007ffe445d9508 </TASK> The root cause is the bad handling of disconnect() generated internally by the MPTCP protocol in case of connect FASTOPEN errors. Address the issue increasing the socket disconnect counter even on such a case, to allow other threads waiting on the same socket lock to properly error out.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux-6.1 | 0 | 6.1.129-1~deb11u1 |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.13-1 |
| Linux | Kernel | 0 | 6.1.129 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_9 | 0 | 1-150600.1.3.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_9 | 0 | 1-150600.13.3.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.42.2.150600.12.18.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.31.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.31.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.31.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.29.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.29.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.29.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.29.1 |
| Ubuntu:24.10 | linux-aws | 0 | 6.11.0-1014.15 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.31.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.42.2.150600.12.18.4 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.31.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.31.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.42.2 |
Related vulnerabilities
- CVE-2025-38177 In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make… Also affects linux-6.1
- CVE-2025-38095 In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert… Also affects linux-6.1
- CVE-2025-38094 In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb… Also affects linux-6.1
- CVE-2025-38023 In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure… Also affects linux-6.1
- CVE-2025-38027 In the Linux kernel, the following vulnerability has been resolved: regulator: max20086… Also affects linux-6.1
- CVE-2025-38024 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix… Also affects linux-6.1
- CVE-2025-38015 In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix… Also affects linux-6.1
- CVE-2025-38020 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable… Also affects linux-6.1