Security readout for executives and security teams
Plain-English summary
A Linux MPTCP bug can miscalculate TCP option space, corrupt network-packet metadata, and crash the kernel. The supplied CVSS rates it critical and remotely reachable without credentials or user action. However, the evidence provided demonstrates a syzbot-triggered crash, not successful system takeover or real-world malicious exploitation.
Executive priority
Treat as an urgent kernel-patching issue on MPTCP-capable, network-exposed, or business-critical Linux systems. Prioritize verified exposure first. The critical score warrants prompt action, while the lack of documented active exploitation means organizations should avoid claiming an ongoing attack campaign without additional evidence.
Technical view
When MPTCP ADD_ADDR and DSS option handling overlap, an incorrect option-length calculation can overflow reserved TCP option space. This corrupts skb shared metadata, including the fragment count, and can cause invalid memory handling during packet cleanup. Stable-kernel commits resolve the logic by enforcing the required option exclusivity.
Likely exposure
Potential exposure exists on affected Linux kernel branches using MPTCP and processing relevant network traffic. The bundle identifies releases across the 5.15, 6.1, 6.6, 6.12, and 6.13 lines, but its flattened version data is ambiguous. Confirm distribution backports and the running kernel rather than relying solely on version numbers.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public weaponized exploit. Syzbot reproduced a kernel fault under testing. The CVSS vector models remote, unauthenticated impact, but the supplied technical evidence directly establishes memory corruption and crashing, not arbitrary code execution.
Researcher notes
The reported KASAN fault occurs during skb cleanup after corruption of fragment metadata. The root cause is MPTCP option-length accounting where ADD_ADDR should exclude DSS. Supplied sources identify stable fixes, but the truncated description and ambiguous affected-version representation limit precise branch-level conclusions; use vendor backport records for final applicability.
Mitigation direction
- Apply a vendor kernel update containing the applicable cited stable fix.
- Prioritize internet-facing or critical systems where MPTCP is enabled or used.
- Check distribution advisories for backported package versions and required maintenance actions.
- Consult vendor guidance for temporary mitigations if immediate patching is impossible.
- Verify the corrected kernel is running after maintenance.
Validation and detection
- Inventory running kernel versions and distribution package revisions.
- Determine whether MPTCP is enabled or actively used on each host.
- Check vendor changelogs for CVE-2024-57882 or the cited stable commits.
- Confirm patched kernel versions after installation and restart procedures.
- Review kernel logs for related protection faults; absence does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-57882 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/88b01048f286bb522f524ad99943ba86797d6514CVE reference, Linux
- https://git.kernel.org/stable/c/09ba95321a269019b5aa8e0c3bc80cf86d91fd18CVE reference, Linux
- https://git.kernel.org/stable/c/53fe947f67c93a5334aed3a7259fcc8a204f8bb6CVE reference, Linux
- https://git.kernel.org/stable/c/fb08e6b0ba284e3dcdc9378de26dcb51d90710f5CVE reference, Linux
- https://git.kernel.org/stable/c/cbb26f7d8451fe56ccac802c6db48d16240feebdCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.