CVE-2025-21707
NoneCVSS
—
EPSS
0.5%
Published
Feb 27, 2025
CISA due date
—
Cloudanix analysis
A flaw in how Linux handles certain network connection options can cause crashes or allow attackers to access unintended memory, requiring urgent operating system updates on affected servers and devices.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use of uninitialized bitfield values in MPTCP suboption status tracking during incoming TCP option parsing leads to undefined behavior in sequence number expansion and mask updates.
Why it matters to the business
Network stack instability, potential kernel panics or crashes on systems using MPTCP, and risk of information disclosure or local privilege escalation in multi-path TCP environments; widespread kernel updates required across Linux distributions.
How an attack unfolds
An attacker triggers specific MPTCP connection teardown or option parsing paths that skip bitfield clearing, causing the kernel to read uninitialized memory when processing incoming packets or subflow management requests.
How to fix it
Upgrade the Linux kernel to a version containing commit 3a7fda57b0f91f7ea34476b165f91a92feb17c96 or later; apply distribution-specific backports; for the nova package update to 2013.2.4 or newer.
How to confirm the fix worked
Confirm kernel version includes the referenced commit; run syzkaller or targeted MPTCP fuzzing to verify absence of the uninit-value path; check /proc/config.gz or build logs for MPTCP fixes.
Typical attack path
- Establish or manipulate an MPTCP connection with specific suboptions
- Trigger subflow removal or address flush via netlink or packet sequences
- Send crafted TCP segments that reach mptcp_incoming_options without proper initialization
- Cause use of uninit values in ack_update_msk and sequence expansion
- Result in KMSAN-detected corruption or exploitable undefined behavior
How to detect it
Review kernel logs for KMSAN uninit-value reports referencing mptcp_incoming_options or __mptcp_expand_seq; inspect netlink audit logs for mptcp_pm_nl_flush_addrs_doit activity; correlate with unexpected TCP connection closures involving subflows.
What your security team should do
- Prioritize kernel updates on all systems exposing MPTCP (high urgency due to memory corruption family)
- Monitor for related kernel privilege escalation activity from similar recent CVEs
- Restrict MPTCP usage or disable via sysctl where not required
- Audit netlink and subflow management code paths for similar initialization issues
The record
In the Linux kernel, the following vulnerability has been resolved: mptcp: consolidate suboption status MPTCP maintains the received sub-options status is the bitmask carrying the received suboptions and in several bitfields carrying per suboption additional info. Zeroing the bitmask before parsing is not enough to ensure a consistent status, and the MPTCP code has to additionally clear some bitfiled depending on the actually parsed suboption. The above schema is fragile, and syzbot managed to trigger a path where a relevant bitfield is not cleared/initialized: BUG: KMSAN: uninit-value in __mptcp_expand_seq net/mptcp/options.c:1030 [inline] BUG: KMSAN: uninit-value in mptcp_expand_seq net/mptcp/protocol.h:864 [inline] BUG: KMSAN: uninit-value in ack_update_msk net/mptcp/options.c:1060 [inline] BUG: KMSAN: uninit-value in mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209 __mptcp_expand_seq net/mptcp/options.c:1030 [inline] mptcp_expand_seq net/mptcp/protocol.h:864 [inline] ack_update_msk net/mptcp/options.c:1060 [inline] mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209 tcp_data_queue+0xb4/0x7be0 net/ipv4/tcp_input.c:5233 tcp_rcv_established+0x1061/0x2510 net/ipv4/tcp_input.c:6264 tcp_v4_do_rcv+0x7f3/0x11a0 net/ipv4/tcp_ipv4.c:1916 tcp_v4_rcv+0x51df/0x5750 net/ipv4/tcp_ipv4.c:2351 ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:447 NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core net/core/dev.c:5704 [inline] __netif_receive_skb+0x319/0xa00 net/core/dev.c:5817 process_backlog+0x4ad/0xa50 net/core/dev.c:6149 __napi_poll+0xe7/0x980 net/core/dev.c:6902 napi_poll net/core/dev.c:6971 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:7093 handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561 __do_softirq+0x14/0x1a kernel/softirq.c:595 do_softirq+0x9a/0x100 kernel/softirq.c:462 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline] __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4493 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0x187c/0x1b70 net/ipv4/ip_output.c:236 __ip_finish_output+0x287/0x810 ip_finish_output+0x4b/0x600 net/ipv4/ip_output.c:324 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x15f/0x3f0 net/ipv4/ip_output.c:434 dst_output include/net/dst.h:450 [inline] ip_local_out net/ipv4/ip_output.c:130 [inline] __ip_queue_xmit+0x1f2a/0x20d0 net/ipv4/ip_output.c:536 ip_queue_xmit+0x60/0x80 net/ipv4/ip_output.c:550 __tcp_transmit_skb+0x3cea/0x4900 net/ipv4/tcp_output.c:1468 tcp_transmit_skb net/ipv4/tcp_output.c:1486 [inline] tcp_write_xmit+0x3b90/0x9070 net/ipv4/tcp_output.c:2829 __tcp_push_pending_frames+0xc4/0x380 net/ipv4/tcp_output.c:3012 tcp_send_fin+0x9f6/0xf50 net/ipv4/tcp_output.c:3618 __tcp_close+0x140c/0x1550 net/ipv4/tcp.c:3130 __mptcp_close_ssk+0x74e/0x16f0 net/mptcp/protocol.c:2496 mptcp_close_ssk+0x26b/0x2c0 net/mptcp/protocol.c:2550 mptcp_pm_nl_rm_addr_or_subflow+0x635/0xd10 net/mptcp/pm_netlink.c:889 mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:924 [inline] mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_netlink.c:1688 [inline] mptcp_nl_flush_addrs_list net/mptcp/pm_netlink.c:1709 [inline] mptcp_pm_nl_flush_addrs_doit+0xe10/0x1630 net/mptcp/pm_netlink.c:1750 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] ---truncated---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux-6.1 | 0 | 6.1.129-1~deb11u1 |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.13-1 |
| Linux | Kernel | 5.11.0 | 5.15.179 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_11 | 0 | 1-150600.1.3.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_11 | 0 | 1-150600.13.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_1 | 0 | 1-150700.15.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.50.1.150600.12.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-64kb | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default-base | 0 | 6.4.0-150700.53.3.1.150700.17.2.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-zfcpdump | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-docs | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-obs-build | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-syms | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.37.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.37.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.37.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-azure | 0 | 6.4.0-150700.20.3.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-source-azure | 0 | 6.4.0-150700.20.3.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-syms-azure | 0 | 6.4.0-150700.20.3.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.39.1 |
| Ubuntu:24.10 | linux-aws | 0 | 6.11.0-1014.15 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.37.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.50.1.150600.12.22.1 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.37.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.37.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.50.1 |
Related vulnerabilities
- CVE-2025-38177 In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make… Also affects linux-6.1
- CVE-2025-38095 In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert… Also affects linux-6.1
- CVE-2025-38094 In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb… Also affects linux-6.1
- CVE-2025-38023 In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure… Also affects linux-6.1
- CVE-2025-38027 In the Linux kernel, the following vulnerability has been resolved: regulator: max20086… Also affects linux-6.1
- CVE-2025-38024 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix… Also affects linux-6.1
- CVE-2025-38015 In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix… Also affects linux-6.1
- CVE-2025-38020 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable… Also affects linux-6.1