CVE-2025-23145

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability has been resolved in the Linux kernel related to the MPTCP protocol. The issue occurs when the kernel panics in 'mptcp can accept new subflow' due to a NULL pointer dereference. This happens when the same request receives two SYN-ACK packets in a short time, potentially caused by client retransmission. The problem arises from concurrent processing of packets on different CPUs, leading to a risk of null pointer dereference. The patch fixes this issue by moving the 'subflow req->msk' under the own req == true conditional.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.