CVE-2022-50070— mptcp: do not queue data on closed subflows
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于MPTCP在关闭子流后仍排队数据导致释放后重用。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | d5f49190def61c47b2faff170ba8fbc48bac4371< fb9c73ef2ac2ec816efdc8b9267bc04e1369c20b |
affected |
d5f49190def61c47b2faff170ba8fbc48bac4371< 8caf5c15b5288d52d9c89374d6c10fa32ee84ec5 |
affected | ||
d5f49190def61c47b2faff170ba8fbc48bac4371< c886d70286bf3ad411eb3d689328a67f7102c6ae |
affected | ||
5.10 |
affected | ||
< 5.10 |
unaffected | ||
5.15.190≤ 5.15.* |
unaffected | ||
5.19.4≤ 5.19.* |
unaffected | ||
6.0≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-50070
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mptcp: do not queue data on closed subflows
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: do not queue data on closed subflows
Dipanjan reported a syzbot splat at close time:
WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153
inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153
Modules linked in: uio_ivshmem(OE) uio(E)
CPU: 1 PID: 10818 Comm: kworker/1:16 Tainted: G OE
5.19.0-rc6-g2eae0556bb9d #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Workqueue: events mptcp_worker
RIP: 0010:inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153
Code: 21 02 00 00 41 8b 9c 24 28 02 00 00 e9 07 ff ff ff e8 34 4d 91
f9 89 ee 4c 89 e7 e8 4a 47 60 ff e9 a6 fc ff ff e8 20 4d 91 f9 <0f> 0b
e9 84 fe ff ff e8 14 4d 91 f9 0f 0b e9 d4 fd ff ff e8 08 4d
RSP: 0018:ffffc9001b35fa78 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000002879d0 RCX: ffff8881326f3b00
RDX: 0000000000000000 RSI: ffff8881326f3b00 RDI: 0000000000000002
RBP: ffff888179662674 R08: ffffffff87e983a0 R09: 0000000000000000
R10: 0000000000000005 R11: 00000000000004ea R12: ffff888179662400
R13: ffff888179662428 R14: 0000000000000001 R15: ffff88817e38e258
FS: 0000000000000000(0000) GS:ffff8881f5f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020007bc0 CR3: 0000000179592000 CR4: 0000000000150ee0
Call Trace:
<TASK>
__sk_destruct+0x4f/0x8e0 net/core/sock.c:2067
sk_destruct+0xbd/0xe0 net/core/sock.c:2112
__sk_free+0xef/0x3d0 net/core/sock.c:2123
sk_free+0x78/0xa0 net/core/sock.c:2134
sock_put include/net/sock.h:1927 [inline]
__mptcp_close_ssk+0x50f/0x780 net/mptcp/protocol.c:2351
__mptcp_destroy_sock+0x332/0x760 net/mptcp/protocol.c:2828
mptcp_worker+0x5d2/0xc90 net/mptcp/protocol.c:2586
process_one_work+0x9cc/0x1650 kernel/workqueue.c:2289
worker_thread+0x623/0x1070 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
</TASK>
The root cause of the problem is that an mptcp-level (re)transmit can
race with mptcp_close() and the packet scheduler checks the subflow
state before acquiring the socket lock: we can try to (re)transmit on
an already closed ssk.
Fix the issue checking again the subflow socket status under the
subflow socket lock protection. Additionally add the missing check
for the fallback-to-tcp case.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于MPTCP在关闭子流后仍排队数据导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-50070
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-50070
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-06-18 · 362 CVEs total
| CVE-2025-38075 | 9.8 CRITICAL | scsi: target: iscsi: Fix timeout on deleted connection |
| CVE-2022-50098 | 8.8 HIGH | scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts |
| CVE-2025-38052 | 8.8 HIGH | net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done |
| CVE-2022-49934 | 8.8 HIGH | wifi: mac80211: Fix UAF in ieee80211_scan_rx() |
| CVE-2022-50164 | 8.8 HIGH | wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue |
| CVE-2025-38016 | 8.8 HIGH | HID: bpf: abort dispatch if device destroyed |
| CVE-2025-38074 | 8.8 HIGH | vhost-scsi: protect vq->log_used with vq->mutex |
| CVE-2022-49974 | 8.8 HIGH | HID: nintendo: fix rumble worker null pointer deref |
| CVE-2022-49968 | 8.0 HIGH | ieee802154/adf7242: defer destroy_workqueue call |
| CVE-2022-49939 | 7.8 HIGH | binder: fix UAF of ref->proc caused by race condition |
| CVE-2022-50022 | 7.8 HIGH | drivers:md:fix a potential use-after-free bug |
| CVE-2022-50028 | 7.8 HIGH | gadgetfs: ep_io - wait until IRQ finishes |
| CVE-2022-49935 | 7.8 HIGH | dma-buf/dma-resv: check if the new fence is really later |
| CVE-2025-38082 | 7.8 HIGH | gpio: virtuser: fix potential out-of-bound write |
| CVE-2022-50182 | 7.8 HIGH | media: imx-jpeg: Align upwards buffer size |
| CVE-2025-38080 | 7.8 HIGH | drm/amd/display: Increase block_sequence array size |
| CVE-2025-38079 | 7.8 HIGH | crypto: algif_hash - fix double free in hash_accept |
| CVE-2025-38060 | 7.8 HIGH | bpf: copy_verifier_state() should copy 'loop_entry' field |
| CVE-2025-38062 | 7.8 HIGH | genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie |
| CVE-2022-50101 | 7.8 HIGH | video: fbdev: vt8623fb: Check the size of screen before memset_io() |
Showing top 20 of 362 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2022-50070
No comments yet