CVE-2022-49198

mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb

MEDIUM

5.5

CVSS Score

Published: February 26, 2025 at 01:55 AM UTC

Updated: June 17, 2026 at 05:17 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb Got crash when doing pressure test of mptcp: =========================================================================== dst_release: dst:ffffa06ce6e5c058 refcnt:-1 kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle kernel paging request at ffffa06ce6e5c058 PGD 190a01067 P4D 190a01067 PUD 43fffb067 PMD 22e403063 PTE 8000000226e5c063 Oops: 0011 [#1] SMP PTI CPU: 7 PID: 7823 Comm: kworker/7:0 Kdump: loaded Tainted: G E Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.2.1 04/01/2014 Call Trace: ? skb_release_head_state+0x68/0x100 ? skb_release_all+0xe/0x30 ? kfree_skb+0x32/0xa0 ? mptcp_sendmsg_frag+0x57e/0x750 ? __mptcp_retrans+0x21b/0x3c0 ? __switch_to_asm+0x35/0x70 ? mptcp_worker+0x25e/0x320 ? process_one_work+0x1a7/0x360 ? worker_thread+0x30/0x390 ? create_worker+0x1a0/0x1a0 ? kthread+0x112/0x130 ? kthread_flush_work_fn+0x10/0x10 ? ret_from_fork+0x35/0x40 =========================================================================== In __mptcp_alloc_tx_skb skb was allocated and skb->tcp_tsorted_anchor will be initialized, in under memory pressure situation sk_wmem_schedule will return false and then kfree_skb. In this case skb->_skb_refdst is not null because_skb_refdst and tcp_tsorted_anchor are stored in the same mem, and kfree_skb will try to release dst and cause crash.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.16 ≤ v < 5.16.195.16 ≤ v < 5.17.25.16 ≤ v < 5.185.17 ≤ v < 5.17.2289f2f58266777f45a52cd55dea96d736e6244c95.16f70cad1085d1e01d3ec73c1078405f906237feee

Vendor states this is fixed in 3ef3905aa3b5b3e222ee6eb0210bfd999417a8cc (fixed)

Vendor states this is fixed in 4d54181eba4b077fb74033a7186898ad4000a7a5 (fixed)

Vendor states this is fixed in 752add6f5ce5305e55d8bda4ac8d69be3a09f14d (fixed)

Vendor states this is fixed in af61a8f7603926c26158153d0a0755764d82657c (fixed)

Vendor states this is fixed in 5.16 (unaffected)

Vendor states this is fixed in 5.16.19 (unaffected)

Vendor states this is fixed in 5.17.2 (unaffected)

Vendor states this is fixed in 5.18 (unaffected)