The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In the Linux kernel, the following vulnerability has been resolved:
mptcp: stricter state check in mptcp_worker
As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state:
connect() // incoming reset + fastclose // the mptcp worker is scheduled mptcp_disconnect() // msk is now CLOSED listen() mptcp_worker()
Leading to the following splat:
divide error: 0000 [#1] PREEMPT SMP CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018 RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293 RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004 RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000 R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:262 [inline] __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345 tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline] tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459 mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline] mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705 process_one_work+0x3bd/0x950 kernel/workqueue.c:2390 worker_thread+0x5b/0x610 kernel/workqueue.c:2537 kthread+0x138/0x170 kernel/kthread.c:376 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 </TASK>
This change addresses the issue explicitly checking for bad states before running the mptcp worker.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.15.108-65.141Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade perf-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.1.25-37.47Upgrade kernel-libbpf-develUpgrade python3-perfUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade kernel-devel | Feb 20, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade linux | Dec 31, 2025 | Dec 31, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 30, 2025 |
| Ubuntu | — | Upgrade linux-bluefieldUpgrade linux-azureUpgrade linux-xilinx-zynqmpUpgrade linux-oracle-5.15Upgrade linux-oracleUpgrade linux-gkeUpgrade linux-nvidiaUpgrade linux-azure-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-realtimeUpgrade linux-azure-fdeUpgrade linux-riscv-5.15Upgrade linux-aws-5.15Upgrade linux-gcp-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-ibmUpgrade linux-raspiUpgrade linux-gcpUpgrade linux-lowlatency-hwe-5.15Upgrade linux-kvmUpgrade linux-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-awsUpgrade linux-lowlatencyUpgrade linuxUpgrade linux-ibm-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-nvidia-tegraUpgrade linux-gkeopUpgrade linux-nvidia-tegra-5.15 | Jan 6, 2026 | Jan 2, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub