CVE-2025-23145

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix NULL pointer in can_accept_new_subflow

When testing valkey benchmark tool with MPTCP, the kernel panics in

'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL.

Call trace:

mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P)

subflow_syn_recv_sock (./net/mptcp/subflow.c:854)

tcp_check_req (./net/ipv4/tcp_minisocks.c:863)

tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268)

ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207)

ip_local_deliver_finish (./net/ipv4/ip_input.c:234)

ip_local_deliver (./net/ipv4/ip_input.c:254)

ip_rcv_finish (./net/ipv4/ip_input.c:449)

...

According to the debug log, the same req received two SYN-ACK in a very

short time, very likely because the client retransmits the syn ack due

to multiple reasons.

Even if the packets are transmitted with a relevant time interval, they

can be processed by the server on different CPUs concurrently). The

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References