CVE-2021-47593

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: clear 'kern' flag from fallback sockets

The mptcp ULP extension relies on sk->sk_sock_kern being set correctly: It prevents setsockopt(fd, IPPROTO_TCP, TCP_ULP, "mptcp", 6); from working for plain tcp sockets (any userspace-exposed socket).

But in case of fallback, accept() can return a plain tcp sk. In such case, sk is still tagged as 'kernel' and setsockopt will work.

This will crash the kernel, The subflow extension has a NULL ctx->conn mptcp socket:

BUG: KASAN: null-ptr-deref in subflow_data_ready+0x181/0x2b0 Call Trace: tcp_data_ready+0xf8/0x370 [..]

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
LinuxLinux>= cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be, < 451f1eded7f56e93aaf52eb547ba97742d9c0e97; >= cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be, < c26ac0ea3a91c210cf90452e625dc441adf3e549; >= cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be, < d6692b3b97bdc165d150f4c1505751a323a80717
LinuxLinux5.6

References

Timeline

Published
Jun 19, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-475945.5In the Linux kernel, the following vulnerability has been resolved: mptcp: never allow the PM to close a listener subflow Currently, when CVE-2021-475955.5In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_ets: don't remove idle classes from the round-robin listCVE-2021-475967.8In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg Currently, tCVE-2021-475975.5In the Linux kernel, the following vulnerability has been resolved: inet_diag: fix kernel-infoleak for UDP sockets KMSAN reported a kernelCVE-2021-475987.8In the Linux kernel, the following vulnerability has been resolved: sch_cake: do not call cake_destroy() from cake_init() qdiscs are not sCVE-2021-475994.7In the Linux kernel, the following vulnerability has been resolved: btrfs: use latest_dev in btrfs_show_devname The test case btrfs/238 reCVE-2021-476007.8In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() Move dm_tmCVE-2021-476015.5In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix an IS_ERR() vs NULL bug The __get_free_pages() functiCVE-2021-476025.5In the Linux kernel, the following vulnerability has been resolved: mac80211: track only QoS data frames for admission control For admissiCVE-2021-476034.4In the Linux kernel, the following vulnerability has been resolved: audit: improve robustness of the audit queue handling If the audit daeCVE-2021-476047.1In the Linux kernel, the following vulnerability has been resolved: vduse: check that offset is within bounds in get_config() This conditiCVE-2021-476057.8In the Linux kernel, the following vulnerability has been resolved: vduse: fix memory corruption in vduse_dev_ioctl() The "config.offset"
CVE-2021-47593: Medium severity, CVSS 5.5 | Vulnix