CVE-2025-68227

What it actually does

The vulnerability allows incorrect comparison of sk_prot during MPTCP fallback in subflow_syn_recv_sock when BPF sockmap has overridden the protocol, resulting in improper sk_socket->ops configuration and a kernel WARNING at mptcp_stream_accept.

Why it matters to the business

Systems relying on MPTCP combined with BPF sockmap may experience kernel warnings or degraded network stack reliability, increasing operational risk for high-availability network services until patched packages are deployed.

How an attack unfolds

An attacker triggers a TCP connection that forces MPTCP fallback while a BPF sockmap is active on the socket; the flawed sk_prot comparison in mptcp_fallback_tcp_ops then misconfigures socket operations, surfacing the warning during accept processing.

How to fix it

Upgrade all listed affected packages to the fixed versions: gitlab-cng-17.8 (Chainguard) to 17.8.2-r0 and equivalent Wolfi/Chainguard updates for gitaly-config, gitlab-base, gitlab-certificates, gitlab-cfssl-self-sign-scripts, gitlab-container-registry and related components through gitlab-geo-logcursor-scripts.

How to confirm the fix worked

Verify package versions match the fixed releases (17.8.2-r0) and confirm absence of the mptcp_stream_accept WARNING in kernel logs after applying updates; re-test MPTCP fallback scenarios under sockmap load.

Typical attack path

1. Establish a TCP connection without MPTCP options to a server with MPTCP enabled
2. Activate BPF sockmap or sockops that calls tcp_bpf_update_proto on the subflow
3. Force subflow_ulp_fallback and mptcp_subflow_ops_undo_override
4. Invoke accept path reaching mptcp_stream_accept which performs the incorrect sk_prot check

How to detect it

Search kernel logs and dmesg for the exact WARNING string referencing mptcp_stream_accept and net/mptcp/protocol.c:68; inspect call traces containing do_accept, __sys_accept4, and entry_SYSCALL_64 to identify prior occurrences.

• WARNING: CPU:.*PID:.*at net/mptcp/protocol.c:68 mptcp_stream_accept
• mptcp_stream_accept (net/mptcp/protocol.c:4005)
• Call Trace:.*do_accept.*__sys_accept4.*__x64_sys_accept

What your security team should do

• Immediately schedule upgrades to the 17.8.2-r0 fixed package versions across all affected GitLab container and config images
• Monitor kernel logs for the mptcp_stream_accept WARNING until patches are deployed
• Prioritize environments using both MPTCP and BPF sockmap for earliest remediation