Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: really cope with fastopen race

Fastopen and PM-trigger subflow shutdown can race, as reported by
syzkaller.

In my first attempt to close such race, I missed the fact that
the subflow status can change again before the subflow_state_change
callback is invoked.

Address the issue additionally copying with all the states directly
reachable from TCP_FIN_WAIT1.

Classification

CVE ID: CVE-2024-26708

Affected Products

Vendor: Linux

Product: Linux

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.05% (probability of being exploited)

EPSS Percentile: 17.81% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2
https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f
https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f

Timeline