CVE-2024-35840

mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()

MEDIUM

5.5

CVSS Score

Published: May 17, 2024 at 02:27 PM UTC

Updated: June 17, 2026 at 07:35 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() subflow_finish_connect() uses four fields (backup, join_id, thmac, none) that may contain garbage unless OPTION_MPTCP_MPJ_SYNACK has been set in mptcp_parse_option()

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.16 ≤ v < 6.1.755.7 ≤ v < 5.15.1485.7 ≤ v < 6.1.755.7 ≤ v < 6.6.145.7 ≤ v < 6.7.25.7 ≤ v < 6.86.2 ≤ v < 6.6.146.7 ≤ v < 6.7.25.7f296234c98a8fcec94eec80304a873f635d350ea

Vendor states this is fixed in 413b913507326972135d2977975dbff8b7f2c453 (fixed)

Vendor states this is fixed in 51e4cb032d49ce094605f27e45eabebc0408893c (fixed)

Vendor states this is fixed in 76e8de7273a22a00d27e9b8b7d4d043d6433416a (fixed)

Vendor states this is fixed in ad3e8f5c3d5c53841046ef7a947c04ad45a20721 (fixed)

Vendor states this is fixed in be1d9d9d38da922bd4beeec5b6dd821ff5a1dfeb (fixed)

Vendor states this is fixed in 5.15.148 (unaffected)

Vendor states this is fixed in 5.7 (unaffected)

Vendor states this is fixed in 6.1.75 (unaffected)

Vendor states this is fixed in 6.6.14 (unaffected)

Vendor states this is fixed in 6.7.2 (unaffected)

Vendor states this is fixed in 6.8 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references