CVE-2024-26826

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix data re-injection from stale subflow

When the MPTCP PM detects that a subflow is stale, all the packet

scheduler must re-inject all the mptcp-level unacked data. To avoid

acquiring unneeded locks, it first try to check if any unacked data

is present at all in the RTX queue, but such check is currently

broken, as it uses TCP-specific helper on an MPTCP socket.

Funnily enough fuzzers and static checkers are happy, as the accessed

memory still belongs to the mptcp_sock struct, and even from a

functional perspective the recovery completed successfully, as

the short-cut test always failed.

A recent unrelated TCP change - commit d5fed5addb2b ("tcp: reorganize

tcp_sock fast path variables") - exposed the issue, as the tcp field

reorganization makes the mptcp code always skip the re-inection.

Fix the issue dropping the bogus call: we are on a slow path, the early

optimization proved once again to be evil.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References