{"cve":"CVE-2025-71088","nvd":{"published":"2026-01-13T16:16:08.460","modified":"2026-10-15T02:18:18.790","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fallback earlier on simult connection\n\nSyzkaller reports a simult-connect race leading to inconsistent fallback\nstatus:\n\n  WARNING: CPU: 3 PID: 33 at net/mptcp/subflow.c:1515 subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1515\n  Modules linked in:\n  CPU: 3 UID: 0 PID: 33 Comm: ksoftirqd/3 Not tainted syzkaller #0 PREEMPT(full)\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n  RIP: 0010:subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1515\n  Code: 89 ee e8 78 61 3c f6 40 84 ed 75 21 e8 8e 66 3c f6 44 89 fe bf 07 00 00 00 e8 c1 61 3c f6 41 83 ff 07 74 09 e8 76 66 3c f6 90 <0f> 0b 90 e8 6d 66 3c f6 48 89 df e8 e5 ad ff ff 31 ff 89 c5 89 c6\n  RSP: 0018:ffffc900006cf338 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: ffff888031acd100 RCX: ffffffff8b7f2abf\n  RDX: ffff88801e6ea440 RSI: ffffffff8b7f2aca RDI: 0000000000000005\n  RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000007\n  R10: 0000000000000004 R11: 0000000000002c10 R12: ffff88802ba69900\n  R13: 1ffff920000d9e67 R14: ffff888046f81800 R15: 0000000000000004\n  FS:  0000000000000000(0000) GS:ffff8880d69bc000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000560fc0ca1670 CR3: 0000000032c3a000 CR4: 0000000000352ef0\n  Call Trace:\n   <TASK>\n   tcp_data_queue+0x13b0/0x4f90 net/ipv4/tcp_input.c:5197\n   tcp_rcv_state_process+0xfdf/0x4ec0 net/ipv4/tcp_input.c:6922\n   tcp_v6_do_rcv+0x492/0x1740 net/ipv6/tcp_ipv6.c:1672\n   tcp_v6_rcv+0x2976/0x41e0 net/ipv6/tcp_ipv6.c:1918\n   ip6_protocol_deliver_rcu+0x188/0x1520 net/ipv6/ip6_input.c:438\n   ip6_input_finish+0x1e4/0x4b0 net/ipv6/ip6_input.c:489\n   NF_HOOK include/linux/netfilter.h:318 [inline]\n   NF_HOOK include/linux/netfilter.h:312 [inline]\n   ip6_input+0x105/0x2f0 net/ipv6/ip6_input.c:500\n   dst_input include/net/dst.h:471 [inline]\n   ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]\n   NF_HOOK include/linux/netfilter.h:318 [inline]\n   NF_HOOK include/linux/netfilter.h:312 [inline]\n   ipv6_rcv+0x264/0x650 net/ipv6/ip6_input.c:311\n   __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5979\n   __netif_receive_skb+0x1d/0x160 net/core/dev.c:6092\n   process_backlog+0x442/0x15e0 net/core/dev.c:6444\n   __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7494\n   napi_poll net/core/dev.c:7557 [inline]\n   net_rx_action+0xa9f/0xfe0 net/core/dev.c:7684\n   handle_softirqs+0x216/0x8e0 kernel/softirq.c:579\n   run_ksoftirqd kernel/softirq.c:968 [inline]\n   run_ksoftirqd+0x3a/0x60 kernel/softirq.c:960\n   smpboot_thread_fn+0x3f7/0xae0 kernel/smpboot.c:160\n   kthread+0x3c2/0x780 kernel/kthread.c:463\n   ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n   </TASK>\n\nThe TCP subflow can process the simult-connect syn-ack packet after\ntransitioning to TCP_FIN1 state, bypassing the MPTCP fallback check,\nas the sk_state_change() callback is not invoked for * -> FIN_WAIT1\ntransitions.\n\nThat will move the msk socket to an inconsistent status and the next\nincoming data will hit the reported splat.\n\nClose the race moving the simult-fallback check at the earliest possible\nstage - that is at syn-ack generation time.\n\nAbout the fixes tags: [2] was supposed to also fix this issue introduced\nby [3]. [1] is required as a dependence: it was not explicitly marked as\na fix, but it is one and it has already been backported before [3]. In\nother words, this commit should be backported up to [3], including [2]\nand [1] if that's not already there.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/25f1ae942c097b7ae4ce5c2b9c6fefb8e3672b86","https://git.kernel.org/stable/c/71154bbe49423128c1c8577b6576de1ed6836830","https://git.kernel.org/stable/c/79f80a7a47849ef1b3c25a0bedcc448b9cb551c1","https://git.kernel.org/stable/c/b5f46a08269265e2f5e87d855287d6d22de0a32b","https://git.kernel.org/stable/c/c9bf315228287653522894df9d851e9b43db9516"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:19:41.481987139+00:00"},"epss":{"cve":"CVE-2025-71088","score":0.00145,"percentile":0.03754,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}