CVE-2022-50071 mptcp: move subflow cleanup in mptcp_destroy_common()
A memory leak in the Linux kernel MPTCP implementation allows attackers to exhaust system resources via failed socket creation, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50071?
CVE-2022-50071 is a high-severity denial of service vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: move subflow cleanup in mptcp_destroy_common()
If the mptcp socket creation fails due to a CGROUP_INET_SOCK_CREATE eBPF program, the MPTCP protocol ends-up leaking all the subflows: the related cleanup happens in __mptcp_destroy_sock() that is not invoked in such code path.
Address the issue moving the subflow sockets cleanup in the mptcp_destroy_common() helper, which is invoked in every msk cleanup path.
Additionally get rid of the intermediate list_splice_init step, which is an unneeded relic from the past.
The issue is present since before the reported root cause commit, but any attempt to backport the fix before that hash will require a complete rewrite.
Which versions are affected by CVE-2022-50071?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50071?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-50071 being exploited?
There is no known exploitation of CVE-2022-50071 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-70352, DEBIAN-CVE-2022-50071, GHSA-vrj8-wvhm-6q8h, ROOT-OS-UBUNTU-2204-CVE-2022-50071, UBUNTU-CVE-2022-50071.