CVE-2023-54085: mptcp: fix NULL pointer dereference on fastopen early fallback

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-24 · updated 2026-10-15

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer dereference on fastopen early fallback In case of early fallback to TCP, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated sock to the caller. The fastopen path does not cope with the above unconditionally dereferencing the subflow context.

Affected products

Linux kernel: 6.2 — fixed in 6.3

How to fix

Upgrade to a fixed version: Linux kernel 6.3. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/95135835519b0ab931c39908b2c99e9fb3c9068b
https://git.kernel.org/stable/c/c0ff6f6da66a7791a32c0234388b1bdc00244917

Get alerted when CVE-2023-54085 or the next vulnerability affects your stack