In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: Fix uaf in __timer_delete_sync
There are two paths to access mptcp_pm_del_add_timer, result in a race condition:
CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb genl_rcv __netif_receive_skb_one_core netlink_rcv_skb NF_HOOK genl_rcv_msg ip_local_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit tcp_v4_do_rcv mptcp_nl_remove_addrs_list tcp_rcv_established mptcp_pm_remove_addrs_and_subflows tcp_data_queue remove_anno_list_by_saddr mptcp_incoming_options mptcp_pm_del_add_timer mptcp_pm_del_add_timer kfree(entry)
In remove_anno_list_by_saddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).
Keeping a reference to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer".
Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock, do not directly access any members of the entry outside the pm lock, which can avoid similar "entry->x" uaf.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade kernel-cross-headersUpgrade rtlaUpgrade kernel-debug-coreUpgrade kernel-64k-modulesUpgrade kernel-debugUpgrade kernel-64k-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-headersUpgrade kernel-modules-coreUpgrade kernel-64k-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-64kUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernelUpgrade kernel-64k-debug-coreUpgrade libperfUpgrade python3-perfUpgrade kernel-zfcpdump-develUpgrade kernel-modulesUpgrade kernel-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-debug-develUpgrade perfUpgrade kernel-zfcpdump-coreUpgrade bpftoolUpgrade kernel-uki-virtUpgrade kernel-tools-libsUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-modules-coreUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade kernel-docUpgrade kernel-64k-debugUpgrade kernel-tools-libs-develUpgrade kernel-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade rvUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debugUpgrade kernel-abi-stablelists | Nov 21, 2024 | Sep 27, 2024 |
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade python-perfUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.227-219.884Upgrade kernel-develUpgrade kernel-livepatch-5.15.168-114.166Upgrade bpftoolUpgrade kernel | Nov 4, 2024 | Sep 27, 2024 |
| Amazon_linux_2023 | — | Upgrade python3-perfUpgrade kernel-develUpgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-livepatch-6.1.111-120.187Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade perf-debuginfoUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernelUpgrade kernel-modules-extraUpgrade kernel-libbpfUpgrade kernel-libbpf-develUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-libbpf-static | Feb 17, 2025 | Sep 27, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Oct 7, 2024 | Sep 27, 2024 |
| Oracle_linux | — | Upgrade kernel | Nov 21, 2024 | Sep 27, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Nov 14, 2024 | Sep 27, 2024 |
| Rocky_linux | — | Upgrade bpftoolUpgrade kernel-cross-headersUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-tools-libsUpgrade kernel-debug-modules-extraUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade perfUpgrade kernel-debug-debuginfoUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-debuginfoUpgrade perf-debuginfo | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade ocfs2-kmp-azureUpgrade dtb-amdUpgrade kernel-source-azureUpgrade dtb-xilinxUpgrade kernel-develUpgrade kernel-kvmsmall-develUpgrade kernel-macrosUpgrade dtb-allwinnerUpgrade dtb-apmUpgrade dtb-appleUpgrade kernel-default-baseUpgrade reiserfs-kmp-rtUpgrade dtb-freescaleUpgrade kernel-devel-rtUpgrade dlm-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-debugUpgrade dtb-renesasUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-rt-develUpgrade kernel-kvmsmallUpgrade dtb-lgUpgrade kernel-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-sourceUpgrade kernel-zfcpdumpUpgrade kernel-obs-qaUpgrade dtb-armUpgrade gfs2-kmp-rtUpgrade kernel-64kb-develUpgrade gfs2-kmp-64kbUpgrade kernel-default-optionalUpgrade dtb-hisiliconUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-64kbUpgrade dtb-amazonUpgrade dtb-mediatekUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-default-develUpgrade kernel-symsUpgrade kernel-debug-develUpgrade kselftests-kmp-64kbUpgrade dtb-socionextUpgrade dlm-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-source-rtUpgrade gfs2-kmp-azureUpgrade dtb-exynosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-vdsoUpgrade dtb-sprdUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade dtb-nvidiaUpgrade gfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-defaultUpgrade kselftests-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-rockchipUpgrade kernel-syms-rtUpgrade kernel-default-base-rebuildUpgrade dtb-broadcomUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-devel-azureUpgrade kernel-azure-optionalUpgrade dtb-amlogicUpgrade dtb-alteraUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade kernel-azureUpgrade dtb-marvellUpgrade kselftests-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-rt-extraUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-rt-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-azure-develUpgrade kernel-default-livepatchUpgrade dtb-qcomUpgrade dlm-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-docsUpgrade kernel-syms-azure | Dec 5, 2025 | Nov 27, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-oem-24.04aUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-1018-oemUpgrade linux-image-ibmUpgrade linux-image-5.15.0-127-lowlatencyUpgrade linux-image-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-20.04Upgrade linux-image-virtualUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1056-gkeopUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.15.0-1071-intel-iotgUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-127-generic-lpaeUpgrade linux-image-5.15.0-1068-nvidia-lowlatencyUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-127-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-gkeUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-5.15.0-1070-gkeUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1066-raspiUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1066-ibmUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-awsUpgrade linux-image-oracleUpgrade linux-image-oem-22.04cUpgrade linux-image-5.15.0-1070-kvmUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-azureUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-5.15.0-1068-nvidiaUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-5.15.0-127-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-5.15.0-127-genericUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1078-azureUpgrade linux-image-intelUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-5.15.0-1073-awsUpgrade linux-image-5.15.0-1072-gcpUpgrade linux-image-5.15.0-1039-xilinx-zynqmpUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-5.15.0-1071-oracleUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-50-lowlatency-64k | Dec 13, 2024 | Sep 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Sep 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub