{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21707", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.751Z", "datePublished": "2025-02-27T02:07:21.084Z", "dateUpdated": "2026-08-05T11:53:47.362Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:53:47.362Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: consolidate suboption status\n\nMPTCP maintains the received sub-options status is the bitmask carrying\nthe received suboptions and in several bitfields carrying per suboption\nadditional info.\n\nZeroing the bitmask before parsing is not enough to ensure a consistent\nstatus, and the MPTCP code has to additionally clear some bitfiled\ndepending on the actually parsed suboption.\n\nThe above schema is fragile, and syzbot managed to trigger a path where\na relevant bitfield is not cleared/initialized:\n\n BUG: KMSAN: uninit-value in __mptcp_expand_seq net/mptcp/options.c:1030 [inline]\n BUG: KMSAN: uninit-value in mptcp_expand_seq net/mptcp/protocol.h:864 [inline]\n BUG: KMSAN: uninit-value in ack_update_msk net/mptcp/options.c:1060 [inline]\n BUG: KMSAN: uninit-value in mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209\n __mptcp_expand_seq net/mptcp/options.c:1030 [inline]\n mptcp_expand_seq net/mptcp/protocol.h:864 [inline]\n ack_update_msk net/mptcp/options.c:1060 [inline]\n mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209\n tcp_data_queue+0xb4/0x7be0 net/ipv4/tcp_input.c:5233\n tcp_rcv_established+0x1061/0x2510 net/ipv4/tcp_input.c:6264\n tcp_v4_do_rcv+0x7f3/0x11a0 net/ipv4/tcp_ipv4.c:1916\n tcp_v4_rcv+0x51df/0x5750 net/ipv4/tcp_ipv4.c:2351\n ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233\n NF_HOOK include/linux/netfilter.h:314 [inline]\n ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\n dst_input include/net/dst.h:460 [inline]\n ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:447\n NF_HOOK include/linux/netfilter.h:314 [inline]\n ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:567\n __netif_receive_skb_one_core net/core/dev.c:5704 [inline]\n __netif_receive_skb+0x319/0xa00 net/core/dev.c:5817\n process_backlog+0x4ad/0xa50 net/core/dev.c:6149\n __napi_poll+0xe7/0x980 net/core/dev.c:6902\n napi_poll net/core/dev.c:6971 [inline]\n net_rx_action+0xa5a/0x19b0 net/core/dev.c:7093\n handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561\n __do_softirq+0x14/0x1a kernel/softirq.c:595\n do_softirq+0x9a/0x100 kernel/softirq.c:462\n __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389\n local_bh_enable include/linux/bottom_half.h:33 [inline]\n rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]\n __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4493\n dev_queue_xmit include/linux/netdevice.h:3168 [inline]\n neigh_hh_output include/net/neighbour.h:523 [inline]\n neigh_output include/net/neighbour.h:537 [inline]\n ip_finish_output2+0x187c/0x1b70 net/ipv4/ip_output.c:236\n __ip_finish_output+0x287/0x810\n ip_finish_output+0x4b/0x600 net/ipv4/ip_output.c:324\n NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n ip_output+0x15f/0x3f0 net/ipv4/ip_output.c:434\n dst_output include/net/dst.h:450 [inline]\n ip_local_out net/ipv4/ip_output.c:130 [inline]\n __ip_queue_xmit+0x1f2a/0x20d0 net/ipv4/ip_output.c:536\n ip_queue_xmit+0x60/0x80 net/ipv4/ip_output.c:550\n __tcp_transmit_skb+0x3cea/0x4900 net/ipv4/tcp_output.c:1468\n tcp_transmit_skb net/ipv4/tcp_output.c:1486 [inline]\n tcp_write_xmit+0x3b90/0x9070 net/ipv4/tcp_output.c:2829\n __tcp_push_pending_frames+0xc4/0x380 net/ipv4/tcp_output.c:3012\n tcp_send_fin+0x9f6/0xf50 net/ipv4/tcp_output.c:3618\n __tcp_close+0x140c/0x1550 net/ipv4/tcp.c:3130\n __mptcp_close_ssk+0x74e/0x16f0 net/mptcp/protocol.c:2496\n mptcp_close_ssk+0x26b/0x2c0 net/mptcp/protocol.c:2550\n mptcp_pm_nl_rm_addr_or_subflow+0x635/0xd10 net/mptcp/pm_netlink.c:889\n mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:924 [inline]\n mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_netlink.c:1688 [inline]\n mptcp_nl_flush_addrs_list net/mptcp/pm_netlink.c:1709 [inline]\n mptcp_pm_nl_flush_addrs_doit+0xe10/0x1630 net/mptcp/pm_netlink.c:1750\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]\n \n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable parser runs on TCP option bytes of received segments (`tcp_v4_rcv → tcp_data_queue → mptcp_incoming_options → mptcp_get_options`), so any remote MPTCP peer of an internet-facing MPTCP-enabled server or proxy can trigger it with crafted packets. No local access is involved at any point on the path.\nAC:L - The attacker fully controls the TCP option layout and can deterministically produce the MP_CAPABLE-with-data plus malformed-DSS combination that leaves `use_ack` set while `data_ack` is never populated; it is repeatable on every packet. Because the RX softirq reuses the same `mptcp_get_options()` stack frame, the attacker can also prime the uninitialized slot with a value of their choosing from a preceding packet.\nPR:N - The attacker is simply the remote endpoint of an MPTCP connection and needs no credentials, capabilities, or local account on the target; there is no authentication or authorization check between packet receive and `mptcp_incoming_options()`.\nUI:N - An MPTCP-enabled server (the primary MPTCP deployment: mobile-network gateways, proxies, load balancers, handset-facing services) processes the attacker's connection and crafted segments automatically in softirq context. No victim action is required.\nS:U - The uninitialized read, the corrupted state, and the resulting disclosure all remain within the kernel's own security authority on the affected host. No VM, sandbox, or IOMMU boundary is crossed.\nC:H - Uninitialized kernel stack memory is consumed as protocol state and, per the syzbot origin chain, propagates through `mptcp_pm_add_addr_signal()` into `mptcp_write_options()`'s `put_unaligned_be32()` and out onto the wire to the remote peer. The leak is repeatable on every packet and every connection, so an attacker can harvest kernel stack contents (pointers, KASLR material, residual softirq data) without bound.\nI:H - The uninitialized/attacker-primed `data_ack` is written into `msk->snd_una`, `msk->wnd_end` and `msk->bytes_acked`, causing `__mptcp_clean_una()` to discard un-acknowledged application payload as if delivered, and uninitialized `data_fin`/`dsn64`/`data_seq` set `msk->rcv_data_fin_seq` to a bogus value that forces a spurious EOF. This is uncontrolled modification of kernel connection state that silently corrupts and truncates the delivered data stream, plus corruption of socket memory accounting via `dfrag_uncharge()`.\nA:H - Corrupting `snd_una`/`wnd_end`/`rcv_data_fin_seq` from garbage stalls, aborts, or prevents termination of MPTCP connections, and the spurious sequence advance reaches the `WARN_ON_ONCE(!msk->recovery)` sites in `__mptcp_clean_una()`, which panics the box on kernels built with `panic_on_warn`. The condition is remotely triggerable at will and repeatable across connections." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/mptcp/options.c", "net/mptcp/protocol.h" ], "versions": [ { "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc", "lessThan": "3a7fda57b0f91f7ea34476b165f91a92feb17c96", "status": "affected", "versionType": "git" }, { "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc", "lessThan": "3b5332d416d151a15742d1b16e7319368e3cc5c6", "status": "affected", "versionType": "git" }, { "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc", "lessThan": "7f6c72b8ef8130760710e337dc8fbe7263954884", "status": "affected", "versionType": "git" }, { "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc", "lessThan": "6169e942370b4b6f9442d35c51519bf6c346843b", "status": "affected", "versionType": "git" }, { "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc", "lessThan": "ba0518f9e8688cd4fcb569e8df2a74874b4f3894", "status": "affected", "versionType": "git" }, { "version": "84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc", "lessThan": "c86b000782daba926c627d2fa00c3f60a75e7472", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/mptcp/options.c", "net/mptcp/protocol.h" ], "versions": [ { "version": "5.11", "status": "affected" }, { "version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.129" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3a7fda57b0f91f7ea34476b165f91a92feb17c96" }, { "url": "https://git.kernel.org/stable/c/3b5332d416d151a15742d1b16e7319368e3cc5c6" }, { "url": "https://git.kernel.org/stable/c/7f6c72b8ef8130760710e337dc8fbe7263954884" }, { "url": "https://git.kernel.org/stable/c/6169e942370b4b6f9442d35c51519bf6c346843b" }, { "url": "https://git.kernel.org/stable/c/ba0518f9e8688cd4fcb569e8df2a74874b4f3894" }, { "url": "https://git.kernel.org/stable/c/c86b000782daba926c627d2fa00c3f60a75e7472" } ], "title": "mptcp: consolidate suboption status", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:35:59.002Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:39:48.745Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ] } ] } }