LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71144: mptcp: ensure context reset on disconnect()

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect() After the blamed commit below, if the MPC subflow is already in TCP_CLOSE status or has fallback to TCP at mptcp_disconnect() time, mptcp_do_fastclose() skips setting the `send_fastclose flag` and the later __mptcp_close_ssk() does not reset anymore the related subflow context. Any later connection will be created with both the `request_mptcp` flag and the msk-level fallback status off (it is unconditionally cleared at MPTCP disconnect time), leading to a warning in subflow_data_ready(): WARNING: CPU: 26 PID: 8996 at net/mptcp/subflow.c:1519 subflow_data_ready (net/mptcp/subflow.c:1519 (discriminator 13)) Modules linked in: CPU: 26 UID: 0 PID: 8996 Comm: syz.22.39 Not tainted 6.18.0-rc7-05427-g11fc074f6c36 #1 PREEMPT(voluntary) Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 RIP: 0010:subflow_data_ready (net/mptcp/subflow.c:1519 (discriminator 13)) Code: 90 0f 0b 90 90 e9 04 fe ff ff e8 b7 1e f5 fe 89 ee bf 07 00 00 00 e8 db 19 f5 fe 83 fd 07 0f 84 35 ff ff ff e8 9d 1e f5 fe 90 <0f> 0b 90 e9 27 ff ff ff e8 8f 1e f5 fe 4c 89 e7 48 89 de e8 14 09 RSP: 0018:ffffc9002646fb30 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88813b218000 RCX: ffffffff825c8435 RDX: ffff8881300b3580 RSI: ffffffff825c8443 RDI: 0000000000000005 RBP: 000000000000000b R08: ffffffff825c8435 R09: 000000000000000b R10: 0000000000000005 R11: 0000000000000007 R12: ffff888131ac0000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f88330af6c0(0000) GS:ffff888a93dd2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88330aefe8 CR3: 000000010ff59000 CR4: 0000000000350ef0 Call Trace: <TASK> tcp_data_ready (net/ipv4/tcp_input.c:5356) tcp_data_queue (net/ipv4/tcp_input.c:5445) tcp_rcv_state_process (net/ipv4/tcp_input.c:7165) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1955) __release_sock (include/net/sock.h:1158 (discriminator 6) net/core/sock.c:3180 (discriminator 6)) release_sock (net/core/sock.c:3737) mptcp_sendmsg (net/mptcp/protocol.c:1763 net/mptcp/protocol.c:1857) inet_sendmsg (net/ipv4/af_inet.c:853 (discriminator 7)) __sys_sendto (net/socket.c:727 (discriminator 15) net/socket.c:742 (discriminator 15) net/socket.c:2244 (discriminator 15)) __x64_sys_sendto (net/socket.c:2247) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f883326702d Address the issue setting an explicit `fastclosing` flag at fastclose time, and checking such flag after mptcp_do_fastclose().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects Multipath TCP disconnect handling. A stale subflow context can survive disconnect and later trigger a kernel warning when data arrives. The source shows a reliability flaw, not confirmed data theft or remote code execution. Business urgency depends on whether affected kernels and MPTCP are in use.

Executive priority

Treat as a kernel maintenance item with uncertain severity. It does not have confirmed active exploitation in the supplied sources, but kernel reliability issues can become operational incidents on critical hosts. Patch through normal urgent kernel-update processes after exposure validation.

Technical view

In MPTCP, mptcp_disconnect() can clear msk-level fallback state while a subflow context is not reset when fastclose is skipped. Later connections may have request_mptcp and fallback both off, causing a WARN in subflow_data_ready(). The resolved change adds explicit fastclosing state and checks it after mptcp_do_fastclose().

Likely exposure

Exposure is limited to Linux systems running affected kernel versions or unpatched downstream builds that use the MPTCP code path. The provided affected-version data is not enough to map every distribution kernel, so validate against vendor advisories and backported stable commits.

Exploitation context

The source includes a syzkaller-style kernel warning trace and states KEV is false. No cited source confirms active exploitation, public weaponization, privilege escalation, data compromise, or remote code execution.

Researcher notes

Evidence supports an MPTCP state-cleanup bug after disconnect and fallback/closed subflow conditions. The observable failure is a WARN in subflow_data_ready(). Impact beyond warning is not established in the provided sources; avoid overstating exploitability without vendor or maintainer impact notes.

Mitigation direction

  • Check Linux distribution advisories for CVE-2025-71144 kernel updates.
  • Apply vendor kernel updates containing the referenced stable fixes.
  • If patching is delayed, assess whether MPTCP is needed on exposed systems.
  • Prioritize systems where kernel warnings can cause service interruption.
  • Track downstream backports rather than relying only on upstream version numbers.

Validation and detection

  • Inventory running Linux kernel versions across servers and appliances.
  • Identify systems with MPTCP enabled or application dependencies on MPTCP.
  • Compare installed kernels with vendor-fixed builds for CVE-2025-71144.
  • Review kernel logs for MPTCP-related WARN traces in subflow_data_ready().
  • Confirm patched kernels include the referenced stable commit lineage.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71144 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9ea05fabce31ff93a0adae8221c58bc6d7b832f3, 3a13454fd098ed51e733958488f8ec62859a9ed8, f6fb2cbc91a81178dea23d463503b4525a76825d, ae155060247be8dcae3802a95bd1bdf93ab3215d, ae155060247be8dcae3802a95bd1bdf93ab3215d, c4f7b0916b95fd2226e5ab98882482b08f52e1c0, 6.1.159, 6.6.119, 6.12.60, 6.17.10unaffected
LinuxLinux6.18, 0, 6.1.164, 6.6.120, 6.12.65, 6.18.5, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.