CVE-2025-71144

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: ensure context reset on disconnect()

After the blamed commit below, if the MPC subflow is already in TCP_CLOSE

status or has fallback to TCP at mptcp_disconnect() time,

mptcp_do_fastclose() skips setting the `send_fastclose flag` and the later

__mptcp_close_ssk() does not reset anymore the related subflow context.

Any later connection will be created with both the `request_mptcp` flag

and the msk-level fallback status off (it is unconditionally cleared at

MPTCP disconnect time), leading to a warning in subflow_data_ready():

WARNING: CPU: 26 PID: 8996 at net/mptcp/subflow.c:1519 subflow_data_ready (net/mptcp/subflow.c:1519 (discriminator 13))

Modules linked in:

CPU: 26 UID: 0 PID: 8996 Comm: syz.22.39 Not tainted 6.18.0-rc7-05427-g11fc074f6c36 #1 PREEMPT(voluntary)

Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011

RIP: 0010:subflow_data_ready (net/mptcp/subflow.c:1519 (discriminator 13))

Code: 90

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References