CVE-2025-38552

Vulnerability

Analysis

CVE-2025-38552 is a race condition in the Linux kernel’s Multipath TCP (MPTCP) implementation. The vulnerability occurs because there are races between subflow fail and subflow creation, analogous to a previously addressed race condition but more difficult to trigger. The root cause is that the socket state that should prevent any additional subflow creation after a fail is not properly protected under certain conditions.

The solution outlined in the description uses a separate flag to track the condition where the socket state should prevent additional subflow creation, with this flag protected by the fallback lock. This flag becomes true when the socket enters fallback or when an MP_FAIL option is received or sent. The field allow_infinite_fallback is now always touched under the relevant lock, and the previous ONCE annotation on write has been removed.

Impact and

Exploitation

A successful exploitation could allow an attacker to bypass the intended failover mechanism, potentially leading to denial of service (DoS) or other unspecified impacts on the stability of MPTCP connections. The vulnerability is rated High with a CVSS v3 score of 7.8, indicating a significant risk. The attack likely requires local access or the ability to inject network packets.

Mitigation and

References

The vulnerability has been patched in the Linux kernel stable tree. Users should update to a kernel version that includes the fix. The fix is identified in stable kernel commits, e.g., at references [2], [3], and [4]. The product SIMATIC CN 4100 is listed as affected by this CVE in a Siemens advisory [1]; users of that product should apply the provided remediation.