Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-68227— mptcp: Fix proto fallback detection with BPF

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于BPF协议回退检测不当，可能导致协议栈处理异常。

AI Predicted 4.9 Difficulty: Moderate EPSS 0.22% · P11

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 0b4f33def7bbde1ce2fea05f116639270e7acdc7< 92c4092fe012ecdfa5fb05d394f1c1d8f91ad81c affected
0b4f33def7bbde1ce2fea05f116639270e7acdc7< 7ee8f015eb47907745e2070184a8ab1e442ac3c4 affected
0b4f33def7bbde1ce2fea05f116639270e7acdc7< 344974ea1a3ca30e4920687b0091bda4438cebdb affected
0b4f33def7bbde1ce2fea05f116639270e7acdc7< 037cc50589643342d69185b663ecf9d26cce91e8 affected
0b4f33def7bbde1ce2fea05f116639270e7acdc7< 9b1980b6f23fa30bf12add19f37c7458625099eb affected
0b4f33def7bbde1ce2fea05f116639270e7acdc7< 1a0d5c74af9b6ba9ffdf1172de5a1a6df5922a00 affected
0b4f33def7bbde1ce2fea05f116639270e7acdc7< c77b3b79a92e3345aa1ee296180d1af4e7031f8f affected
5.7 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-68227

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mptcp: Fix proto fallback detection with BPF
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix proto fallback detection with BPF The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing with sockmap's custom read/write interfaces. ''' tcp_rcv_state_process() syn_recv_sock()/subflow_syn_recv_sock() tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) bpf_skops_established <== sockops bpf_sock_map_update(sk) <== call bpf helper tcp_bpf_update_proto() <== update sk_prot ''' When the server has MPTCP enabled but the client sends a TCP SYN without MPTCP, subflow_syn_recv_sock() performs a fallback on the subflow, replacing the subflow sk's sk_prot with the native sk_prot. ''' subflow_syn_recv_sock() subflow_ulp_fallback() subflow_drop_ctx() mptcp_subflow_ops_undo_override() ''' Then, this subflow can be normally used by sockmap, which replaces the native sk_prot with sockmap's custom sk_prot. The issue occurs when the user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops(). Here, it uses sk->sk_prot to compare with the native sk_prot, but this is incorrect when sockmap is used, as we may incorrectly set sk->sk_socket->ops. This fix uses the more generic sk_family for the comparison instead. Additionally, this also prevents a WARNING from occurring: result from ./scripts/decode_stacktrace.sh: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \ (net/mptcp/protocol.c:4005) Modules linked in: ... PKRU: 55555554 Call Trace: <TASK> do_accept (net/socket.c:1989) __sys_accept4 (net/socket.c:2028 net/socket.c:2057) __x64_sys_accept (net/socket.c:2067) x64_sys_call (arch/x86/entry/syscall_64.c:41) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f87ac92b83d ---[ end trace 0000000000000000 ]---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于BPF协议回退检测不当，可能导致协议栈处理异常。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0b4f33def7bbde1ce2fea05f116639270e7acdc7 ~ 92c4092fe012ecdfa5fb05d394f1c1d8f91ad81c -
Linux Linux 5.7 -

II. Public POCs for CVE-2025-68227

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-68227

请登录查看更多情报信息。

Other References for CVE-2025-68227 (7)

Same Patch Batch · Linux · 2025-12-16 · 156 CVEs total

CVE-2025-68285 9.8 CRITICAL libceph: fix potential use-after-free in have_mon_and_osd_map()
CVE-2025-40350 9.8 CRITICAL net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
CVE-2025-68263 9.8 CRITICAL ksmbd: ipc: fix use-after-free in ipc_msg_send_request
CVE-2025-68192 9.8 CRITICAL net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
CVE-2025-68301 9.8 CRITICAL net: atlantic: fix fragment overflow handling in RX path
CVE-2025-68284 9.8 CRITICAL libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
CVE-2025-68315 9.8 CRITICAL f2fs: fix to detect potential corrupted nid in free_nid_list
CVE-2025-68255 8.8 HIGH staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
CVE-2025-68226 8.8 HIGH smb: client: fix incomplete backport in cfids_invalidation_worker()
CVE-2025-68256 8.8 HIGH staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
CVE-2025-68314 8.8 HIGH drm/msm: make sure last_fence is always updated
CVE-2025-40362 8.8 HIGH ceph: fix multifs mds auth caps issue
CVE-2025-68304 8.8 HIGH Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
CVE-2025-68250 8.2 HIGH hung_task: fix warnings caused by unaligned lock pointers
CVE-2025-68181 7.8 HIGH drm/radeon: Remove calls to drm_put_dev()
CVE-2025-68179 7.8 HIGH s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
CVE-2025-68175 7.8 HIGH media: nxp: imx8-isi: Fix streaming cleanup on release
CVE-2025-68207 7.8 HIGH drm/xe/guc: Synchronize Dead CT worker with unbind
CVE-2025-68265 7.8 HIGH nvme: fix admin request_queue lifetime
CVE-2025-68208 7.8 HIGH bpf: account for current allocated stack depth in widen_imprecise_scalars()

Showing top 20 of 156 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-68227

No comments yet

Leave a comment