LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54176: mptcp: stricter state check in mptcp_worker

In the Linux kernel, the following vulnerability has been resolved: mptcp: stricter state check in mptcp_worker As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state: connect() // incoming reset + fastclose // the mptcp worker is scheduled mptcp_disconnect() // msk is now CLOSED listen() mptcp_worker() Leading to the following splat: divide error: 0000 [#1] PREEMPT SMP CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018 RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293 RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004 RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000 R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:262 [inline] __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345 tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline] tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459 mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline] mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705 process_one_work+0x3bd/0x950 kernel/workqueue.c:2390 worker_thread+0x5b/0x610 kernel/workqueue.c:2537 kthread+0x138/0x170 kernel/kthread.c:376 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 </TASK> This change addresses the issue explicitly checking for bad states before running the mptcp worker.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel MPTCP bug. Under a specific socket-state race, a delayed worker can process a closed socket and trigger a kernel divide error. The documented impact is a crash trace, so treat it primarily as an availability risk for systems that enable or rely on Multipath TCP.

Executive priority

Schedule remediation in normal vulnerability cycles, with faster action for systems using MPTCP in production or availability-sensitive environments. Current evidence supports a kernel availability concern, not confirmed active exploitation.

Technical view

mptcp_worker can run when the associated MPTCP socket is in an unexpected CLOSED state after reset/fastclose and disconnect/listen transitions. The fault occurs during TCP window selection while sending an active reset. The upstream fix adds stricter bad-state checks before worker processing.

Likely exposure

Exposure is most relevant to Linux systems with MPTCP enabled or reachable through MPTCP paths. The bundle identifies Linux kernel versions and stable commits, but does not provide distribution-specific package names or default MPTCP enablement status.

Exploitation context

The source describes a reproducible state sequence and kernel crash trace, but provides no KEV listing, public exploitation claim, exploit maturity, or remote attack confirmation. Do not assume active exploitation from the supplied evidence.

Researcher notes

The core issue is an MPTCP worker state validation flaw after socket state transitions. The provided record lacks CVSS, CWE, exploitability analysis, and distro mapping. Validation should focus on kernel lineage, backported fixes, and MPTCP exposure.

Mitigation direction

  • Check vendor kernel advisories for CVE-2023-54176 package status.
  • Update to a kernel containing the referenced stable fixes.
  • Inventory systems where MPTCP is enabled or exposed.
  • Prioritize internet-facing or high-availability Linux hosts first.
  • Monitor kernel logs for MPTCP-related crashes until patched.

Validation and detection

  • Confirm running kernel versions against vendor CVE guidance.
  • Verify whether MPTCP is enabled on affected Linux systems.
  • Check whether installed kernels include the referenced stable commits.
  • Review logs for divide errors in mptcp_worker or TCP output paths.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54176 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe16163b6e2b720fb74e5af758546f6dad27e6c9e, e16163b6e2b720fb74e5af758546f6dad27e6c9e, e16163b6e2b720fb74e5af758546f6dad27e6c9e, e16163b6e2b720fb74e5af758546f6dad27e6c9eunaffected
LinuxLinux5.11, 0, 5.15.108, 6.1.25, 6.2.12, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.