Log in Start free

Vulnerability · Published Dec 30, 2025 · Assigned by Linux

CVE-2023-54176mptcp: stricter state check in mptcp_worker

Unrated

In plain English

A security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 90.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: mptcp: stricter state check in mptcp_worker As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state: connect() // incoming reset + fastclose // the mptcp worker is scheduled mptcp_disconnect() // msk is now CLOSED listen() mptcp_worker() Leading to the following splat: divide error: 0000 [#1] PREEMPT SMP CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018 RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293 RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004 RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000 R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:262 [inline] __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345 tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline] tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459 mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline] mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705 process_one_work+0x3bd/0x950 kernel/workqueue.c:2390 worker_thread+0x5b/0x610 kernel/workqueue.c:2537 kthread+0x138/0x170 kernel/kthread.c:376 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 </TASK> This change addresses the issue explicitly checking for bad states before running the mptcp worker.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.25-1DEBIAN-CVE-2023-54176
Debian:13linux6.1.25-1DEBIAN-CVE-2023-54176
Debian:14linux6.1.25-1DEBIAN-CVE-2023-54176
Ubuntu:22.04:LTSlinux5.15.0-79.86UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-aws5.15.0-1042.47UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-azure5.15.0-1045.52UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1045.52.1UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-gcp5.15.0-1039.47UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-gke5.15.0-1039.44UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1025.30UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-ibm5.15.0-1035.38UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1037.42UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-kvm5.15.0-1039.44UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-79.88UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1030.30UBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1016.16UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1002.2UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-oracle5.15.0-1040.46UBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-raspi5.15.0-1035.38UBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-54176
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2023-54176
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1025.29UBUNTU-CVE-2023-54176

Affected products (as reported)

VendorProductVersions
Linux Linux e16163b6e2b720fb74e5af758546f6dad27e6c9e – before f0b4a4086cf27240fc621a560da9735159049dcce16163b6e2b720fb74e5af758546f6dad27e6c9e – before aff9099e9c51f15c8def05c75b2b73e8487b5d54e16163b6e2b720fb74e5af758546f6dad27e6c9e – before 19ea79e87af32c2b3c6fc49bd84efeb35ca57678e16163b6e2b720fb74e5af758546f6dad27e6c9e – before d6a0443733434408f2cbd4c53fea6910599bab9e
Linux Linux 5.11

References