GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-53122 (GCVE-0-2024-53122)

Vulnerability from cvelistv5 – Published: 2024-12-02 13:44 – Updated: 2026-08-05 11:43
VLAI
Title
mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs. A racing recvmsg() spooling data received on an already established subflow would unconditionally call tcp_cleanup_rbuf() on all the current subflows, potentially hitting a divide by zero error on the newly created ones. Explicitly check that the subflow is in a suitable state before invoking tcp_cleanup_rbuf().
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < 0a9a182ea5c7bb0374e527130fd85024ace7279b (git)
Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < 24995851d58c4a205ad0ffa7b2f21e479a9c8527 (git)
Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < ff825ab2f455299c0c7287550915a8878e2a66e0 (git)
Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < aad6412c63baa39dd813e81f16a14d976b3de2e8 (git)
Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < ce7356ae35943cc6494cc692e62d51a734062b7d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.119 , ≤ 6.1.* (semver)
Unaffected: 6.6.63 , ≤ 6.6.* (semver)
Unaffected: 6.11.10 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:29:28.992Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a9a182ea5c7bb0374e527130fd85024ace7279b",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            },
            {
              "lessThan": "24995851d58c4a205ad0ffa7b2f21e479a9c8527",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            },
            {
              "lessThan": "ff825ab2f455299c0c7287550915a8878e2a66e0",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            },
            {
              "lessThan": "aad6412c63baa39dd813e81f16a14d976b3de2e8",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            },
            {
              "lessThan": "ce7356ae35943cc6494cc692e62d51a734062b7d",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.119",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.63",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.10",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: cope racing subflow creation in mptcp_rcv_space_adjust\n\nAdditional active subflows - i.e. created by the in kernel path\nmanager - are included into the subflow list before starting the\n3whs.\n\nA racing recvmsg() spooling data received on an already established\nsubflow would unconditionally call tcp_cleanup_rbuf() on all the\ncurrent subflows, potentially hitting a divide by zero error on\nthe newly created ones.\n\nExplicitly check that the subflow is in a suitable state before\ninvoking tcp_cleanup_rbuf()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is reached from `mptcp_recvmsg()` processing data delivered by a remote MPTCP peer, and the racing subflow creation is triggered by remote MPTCP signalling (ADD_ADDR handling in the in-kernel path manager) over the TCP/IP stack. No local access is needed \u2014 any host terminating MPTCP connections is exposed to its peers.\nAC:L - The attacker controls both sides of the race: it drives the bulk data flow that forces `mptcp_rcv_space_adjust()` into the subflow loop and drives new-subflow creation via ADD_ADDR/RM_ADDR announcements (which can point at a blackholed address to widen the non-established window), and can retry the sequence indefinitely at no cost.\nPR:N - MPTCP data and ADD_ADDR option processing carry no authentication or authorization check, so an unauthenticated remote peer on an established MPTCP connection reaches the code. Even in the purely local scenario, the MPTCP path-manager netlink family uses GENL_UNS_ADMIN_PERM and is therefore usable by an unprivileged user inside `unshare -Urn`.\nUI:N - No victim action is required \u2014 an MPTCP-enabled server accepting connections, or a client already exchanging data, hits the path automatically as the kernel path manager creates additional subflows.\nS:U - The crash occurs in the kernel\u0027s own TCP/MPTCP receive path and affects only the kernel\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an arithmetic exception on a zero `icsk_ack.rcv_mss`; no memory is read out of bounds and no kernel data is copied to the attacker or to userspace.\nI:N - Nothing is written out of bounds or corrupted \u2014 the faulting instruction traps before any state modification, so there is no write primitive or control-flow influence.\nA:H - The divide-by-zero raises a #DE in kernel context, producing an oops that kills the receiving task while it holds the MPTCP socket lock and the subflow\u0027s fast lock, permanently wedging the socket; on systems with `panic_on_oops` set it is an immediate full kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:53.003Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a9a182ea5c7bb0374e527130fd85024ace7279b"
        },
        {
          "url": "https://git.kernel.org/stable/c/24995851d58c4a205ad0ffa7b2f21e479a9c8527"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff825ab2f455299c0c7287550915a8878e2a66e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/aad6412c63baa39dd813e81f16a14d976b3de2e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce7356ae35943cc6494cc692e62d51a734062b7d"
        }
      ],
      "title": "mptcp: cope racing subflow creation in mptcp_rcv_space_adjust",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53122",
    "datePublished": "2024-12-02T13:44:52.678Z",
    "dateReserved": "2024-11-19T17:17:24.994Z",
    "dateUpdated": "2026-08-05T11:43:53.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53122",
      "date": "2026-09-04",
      "epss": "0.00527",
      "percentile": "0.42665"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53122\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-02T14:15:13.010\",\"lastModified\":\"2026-08-04T11:21:55.860\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: cope racing subflow creation in mptcp_rcv_space_adjust\\n\\nAdditional active subflows - i.e. created by the in kernel path\\nmanager - are included into the subflow list before starting the\\n3whs.\\n\\nA racing recvmsg() spooling data received on an already established\\nsubflow would unconditionally call tcp_cleanup_rbuf() on all the\\ncurrent subflows, potentially hitting a divide by zero error on\\nthe newly created ones.\\n\\nExplicitly check that the subflow is in a suitable state before\\ninvoking tcp_cleanup_rbuf().\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: creaci\u00f3n de subflujo de ejecuci\u00f3n en mptcp_rcv_space_adjust Los subflujos activos adicionales (es decir, creados por el administrador de rutas en el kernel) se incluyen en la lista de subflujos antes de iniciar 3whs. Un recvmsg() de ejecuci\u00f3n que pone en cola los datos recibidos en un subflujo ya establecido llamar\u00eda incondicionalmente a tcp_cleanup_rbuf() en todos los subflujos actuales, lo que podr\u00eda provocar un error de divisi\u00f3n por cero en los reci\u00e9n creados. Verifique expl\u00edcitamente que el subflujo est\u00e9 en un estado adecuado antes de invocar tcp_cleanup_rbuf().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mptcp/protocol.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c76c6956566f974bac2470bd72fc22fb923e04a1\",\"lessThan\":\"0a9a182ea5c7bb0374e527130fd85024ace7279b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c76c6956566f974bac2470bd72fc22fb923e04a1\",\"lessThan\":\"24995851d58c4a205ad0ffa7b2f21e479a9c8527\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c76c6956566f974bac2470bd72fc22fb923e04a1\",\"lessThan\":\"ff825ab2f455299c0c7287550915a8878e2a66e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c76c6956566f974bac2470bd72fc22fb923e04a1\",\"lessThan\":\"aad6412c63baa39dd813e81f16a14d976b3de2e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c76c6956566f974bac2470bd72fc22fb923e04a1\",\"lessThan\":\"ce7356ae35943cc6494cc692e62d51a734062b7d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mptcp/protocol.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.119\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.63\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.10\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"6.1.119\",\"matchCriteriaId\":\"6A2C9B37-E912-41BB-9EF9-3BC3C5E13B09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.63\",\"matchCriteriaId\":\"8800BB45-48BC-4B52-BDA5-B1E4633F42E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.10\",\"matchCriteriaId\":\"C256F46A-AFDD-4B99-AA4F-67D9D9D2C55A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B88717-53F5-42AA-9B72-14C707639E3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EF8CD82-1EAE-4254-9545-F85AB94CF90F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a9a182ea5c7bb0374e527130fd85024ace7279b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/24995851d58c4a205ad0ffa7b2f21e479a9c8527\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aad6412c63baa39dd813e81f16a14d976b3de2e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce7356ae35943cc6494cc692e62d51a734062b7d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff825ab2f455299c0c7287550915a8878e2a66e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:52:51+00:00",
      "cve": "CVE-2024-53122",
      "id": "CVE-2024-53122",
      "initial_release_date": "2024-12-02T00:00:00+00:00",
      "product_status:fixed": "1654",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53122.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.