CVE-2025-23145 mptcp: fix NULL pointer in can_accept_new_subflow
A race condition in the Linux kernel MPTCP implementation causes a null pointer dereference and kernel panic when processing concurrent SYN-ACK packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-23145?
CVE-2025-23145 is a high-severity vulnerability in Debian Debian Linux, published on 1 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix NULL pointer in can_accept_new_subflow
When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL.
Call trace:
mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268) ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207) ip_local_deliver_finish (./net/ipv4/ip_input.c:234) ip_local_deliver (./net/ipv4/ip_input.c:254) ip_rcv_finish (./net/ipv4/ip_input.c:449) ...
According to the debug log, the same req received two SYN-ACK in a very short time, very likely because the client retransmits the syn ack due to multiple reasons.
Even if the packets are transmitted with a relevant time interval, they can be processed by the server on different CPUs concurrently). The 'subflow_req->msk' ownership is transferred to the subflow the first, and there will be a risk of a null pointer dereference here.
This patch fixes this issue by moving the 'subflow_req->msk' under the `own_req == true` conditional.
Note that the !msk check in subflow_hmac_valid() can be dropped, because the same check already exists under the own_req mpj branch where the code has been moved to.
Weakness: CWE-476
Which versions are affected by CVE-2025-23145?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-23145?
Apply the vendor's patch.
Is CVE-2025-23145 being exploited?
There is no known exploitation of CVE-2025-23145 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-23145, DEBIAN-CVE-2025-23145, GHSA-3r7x-52q9-w4pw, ROOT-OS-DEBIAN-12-CVE-2025-23145, ROOT-OS-UBUNTU-2204-CVE-2025-23145, ROOT-OS-UBUNTU-2404-CVE-2025-23145 and 1 more.