PT-2024-35588 · Linux+11 · Linux Kernel+11
Published
2024-11-08
·
Updated
2026-03-14
·
CVE-2024-53122
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.65
Description
The issue concerns a vulnerability in the Linux kernel related to the
mptcp rcv space adjust function, where additional active subflows created by the in-kernel path manager are included in the subflow list before starting the 3whs. A racing recvmsg() call that queues data received on an already established subflow could unconditionally call tcp cleanup rbuf() on all current subflows, potentially causing a divide by zero error on newly created ones. To address this, the kernel now explicitly checks that the subflow is in a suitable state before invoking tcp cleanup rbuf().Recommendations
For Linux kernel versions prior to 6.6.65, update to version 6.6.65 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
mptcp rcv space adjust function until a patch is available. Avoid using the recvmsg() function on already established subflows in vulnerable versions to minimize the risk of exploitation.Exploit
Fix
DoS
Race Condition
Divide By Zero
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu