In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: only set fullmesh for subflow endp
With the in-kernel path-manager, it is possible to change the 'fullmesh' flag. The code in mptcp_pm_nl_fullmesh() expects to change it only on 'subflow' endpoints, to recreate more or less subflows using the linked address.
Unfortunately, the set_flags() hook was a bit more permissive, and allowed 'implicit' endpoints to get the 'fullmesh' flag while it is not allowed before.
That's what syzbot found, triggering the following warning:
WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 __mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064 Modules linked in: CPU: 0 UID: 0 PID: 6499 Comm: syz.1.413 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline] RIP: 0010:mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline] RIP: 0010:mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline] RIP: 0010:mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064 Code: 01 00 00 49 89 c5 e8 fb 45 e8 f5 e9 b8 fc ff ff e8 f1 45 e8 f5 4c 89 f7 be 03 00 00 00 e8 44 1d 0b f9 eb a0 e8 dd 45 e8 f5 90 <0f> 0b 90 e9 17 ff ff ff 89 d9 80 e1 07 38 c1 0f 8c c9 fc ff ff 48 RSP: 0018:ffffc9000d307240 EFLAGS: 00010293 RAX: ffffffff8bb72e03 RBX: 0000000000000000 RCX: ffff88807da88000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000d307430 R08: ffffffff8bb72cf0 R09: 1ffff1100b842a5e R10: dffffc0000000000 R11: ffffed100b842a5f R12: ffff88801e2e5ac0 R13: ffff88805c214800 R14: ffff88805c2152e8 R15: 1ffff1100b842a5d FS: 00005555619f6500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002840 CR3: 00000000247e6000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583 ___sys_sendmsg net/socket.c:2637 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5fe8785d29 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff571f5558 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f5fe8975fa0 RCX: 00007f5fe8785d29 RDX: 0000000000000000 RSI: 0000000020000480 RDI: 0000000000000007 RBP: 00007f5fe8801b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5fe8975fa0 R14: 00007f5fe8975fa0 R15: 000000 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.1.129-138.220Upgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade bpftoolUpgrade perfUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernelUpgrade python3-perfUpgrade kernel-libbpf-develUpgrade kernel-tools-develUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-modules-extra-common | Jun 11, 2025 | Feb 27, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Mar 17, 2025 | Feb 27, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2025 |
| Suse | — | Upgrade kselftests-kmp-64kbUpgrade dlm-kmp-rtUpgrade dtb-amdUpgrade dtb-sprdUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade dtb-alteraUpgrade dtb-broadcomUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade dtb-socionextUpgrade dtb-caviumUpgrade kernel-devel-azureUpgrade kernel-docs-htmlUpgrade kernel-rt-vdsoUpgrade kernel-debug-develUpgrade kernel-64kb-optionalUpgrade kernel-azure-optionalUpgrade kernel-debug-vdsoUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade kernel-default-vdsoUpgrade gfs2-kmp-azureUpgrade dtb-marvellUpgrade dtb-lgUpgrade kernel-source-azureUpgrade dtb-amazonUpgrade dtb-exynosUpgrade dtb-allwinnerUpgrade gfs2-kmp-defaultUpgrade kernel-azureUpgrade dlm-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-source-rtUpgrade dtb-appleUpgrade kernel-64kb-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-default-livepatchUpgrade kernel-azure-extraUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-azureUpgrade kernel-64kbUpgrade kernel-azure-develUpgrade kernel-rt-extraUpgrade kernel-syms-azureUpgrade kernel-rt_debugUpgrade kernel-sourceUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-develUpgrade kernel-default-optionalUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade dtb-renesasUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-zfcpdumpUpgrade dtb-hisiliconUpgrade kernel-syms-rtUpgrade kernel-symsUpgrade kernel-macrosUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-64kb-develUpgrade cluster-md-kmp-defaultUpgrade kernel-default-baseUpgrade dtb-qcomUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-docsUpgrade gfs2-kmp-64kbUpgrade dtb-apmUpgrade dtb-mediatekUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade dtb-xilinxUpgrade kernel-debugUpgrade dtb-amlogicUpgrade kernel-develUpgrade kernel-default-base-rebuildUpgrade kernel-rtUpgrade cluster-md-kmp-rtUpgrade dtb-armUpgrade kernel-defaultUpgrade kselftests-kmp-rt | Apr 9, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-image-raspi-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-6.11.0-1015-gcpUpgrade linux-image-6.11.0-1014-lowlatency-64kUpgrade linux-image-generic-6.8Upgrade linux-image-kvmUpgrade linux-image-6.8.0-2028-raspi-realtimeUpgrade linux-image-aws-6.8Upgrade linux-image-azureUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-6.11.0-1013-raspiUpgrade linux-image-aws-64kUpgrade linux-image-azure-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-78-genericUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-raspiUpgrade linux-image-gke-6.8Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1035-nvidia-lowlatencyUpgrade linux-image-6.8.0-78-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1035-awsUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1036-gcpUpgrade linux-image-6.11.0-1014-awsUpgrade linux-image-gkeopUpgrade linux-image-ibm-classicUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1019-gkeopUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1035-nvidia-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.11.0-1016-oracleUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-fde-6.8Upgrade linux-image-6.11.0-26-genericUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1032-oracle-64kUpgrade linux-image-6.11.0-1010-realtimeUpgrade linux-image-6.11.0-1014-lowlatencyUpgrade linux-image-6.8.0-1033-ibmUpgrade linux-image-6.8.0-1034-azureUpgrade linux-image-ibm-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.11.0-1016-oracle-64kUpgrade linux-image-6.11.0-1015-azure-fdeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidiaUpgrade linux-image-lowlatency-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-6.11.0-1015-azureUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-awsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1036-gcp-64kUpgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1032-oracleUpgrade linux-image-6.11.0-1015-gcp-64kUpgrade linux-image-6.8.0-1035-nvidia-64kUpgrade linux-image-6.8.0-78-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1032-gkeUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1035-raspiUpgrade linux-image-oracleUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.1-1030-realtimeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.11.0-1022-oemUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-78-lowlatencyUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.11.0-26-generic-64kUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1035-aws-64kUpgrade linux-image-6.8.0-1035-nvidiaUpgrade linux-image-genericUpgrade linux-image-nvidia-6.8 | May 21, 2025 | Feb 27, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Feb 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub