CVE-2025-68227

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: Fix proto fallback detection with BPF

The sockmap feature allows bpf syscall from userspace, or based

on bpf sockops, replacing the sk_prot of sockets during protocol stack

processing with sockmap's custom read/write interfaces.

'''

tcp_rcv_state_process()

syn_recv_sock()/subflow_syn_recv_sock()

tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)

bpf_skops_established <== sockops

bpf_sock_map_update(sk) <== call bpf helper

tcp_bpf_update_proto() <== update sk_prot

'''

When the server has MPTCP enabled but the client sends a TCP SYN

without MPTCP, subflow_syn_recv_sock() performs a fallback on the

subflow, replacing the subflow sk's sk_prot with the native sk_prot.

'''

subflow_syn_recv_sock()

subflow_ulp_fallback()

subflow_drop_ctx()

mptcp_subflow_ops_undo_override()

'''

Then, this subflow can be normally used by sockmap, which replaces the

native sk_prot

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References