CVE-2025-38552: Linux Kernel Race Condition Vulnerability

CVE-2025-38552 Overview

CVE-2025-38552 is a race condition vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation. The flaw exists between subflow failure handling and additional subflow creation paths. The allow_infinite_fallback field was previously accessed without consistent locking, creating a window where concurrent subflow operations could corrupt kernel state.

The upstream fix introduces a separate flag tracking the condition socket state prevent any additional subflow creation, protected by the fallback lock. The patch also removes the ONCE annotation on writes to allow_infinite_fallback since the field is now always touched under the relevant lock.

Critical Impact
A local, authenticated attacker triggering MPTCP subflow race conditions can compromise kernel confidentiality, integrity, and availability on affected Linux systems.

Affected Products

Linux Kernel (multiple versions, including 6.16-rc1 through 6.16-rc6)
Debian Linux 11.0
Siemens products bundling affected kernels (see Siemens Security Advisory)

Discovery Timeline

2025-08-16 - CVE-2025-38552 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38552

Vulnerability Analysis

Multipath TCP (MPTCP) allows a single TCP connection to use multiple network paths concurrently by creating additional subflows. The Linux kernel maintains state that governs whether new subflows can be created, including responses to MP_FAIL option processing and connection fallback events.

The race window opens when one code path is failing an existing subflow while another attempts to create a new subflow. Without coordinated locking, both paths observe and mutate shared state inconsistently. This leads to logic that assumes fallback has occurred while additional subflows continue to be added, or the inverse.

The vulnerability aligns with kernel concurrency defects under [CWE-362] Race Condition semantics. Exploitation requires local access and the ability to open MPTCP sockets, but does not require elevated privileges.

Root Cause

The root cause is inconsistent synchronization on the allow_infinite_fallback field within MPTCP socket state. The field was written with WRITE_ONCE but read and evaluated outside the fallback lock. Sending or receiving an MP_FAIL option, or triggering socket fallback, transitions the socket into a state that should preclude new subflows, but concurrent subflow creation paths did not observe this transition atomically.

Attack Vector

A local attacker with the ability to create MPTCP sockets can time subflow creation requests against MP_FAIL or fallback events on a peer connection. Repeated attempts can hit the narrow race window. The upstream commit message notes the race is harder to trigger than a previously addressed sibling defect, but the impact profile is the same: kernel memory or state corruption enabling privilege escalation or denial of service.

No public proof-of-concept is available. See the upstream fix commits, including kernel.org commit c476d627 and kernel.org commit f81b6fbe, for the exact state machine changes.

Detection Methods for CVE-2025-38552

Indicators of Compromise

Unexpected kernel oopses or warnings referencing mptcp symbols such as mptcp_pm_mp_fail_received or subflow allocation paths.
Local processes repeatedly opening IPPROTO_MPTCP sockets and forcing subflow additions and failures in tight loops.
Kernel logs showing MPTCP fallback events adjacent to subflow-add operations from the same PID.

Detection Strategies

Inventory hosts running affected kernel versions and identify those with MPTCP enabled via sysctl net.mptcp.enabled.
Correlate audit records of socket(AF_INET, SOCK_STREAM, IPPROTO_MPTCP) calls with subsequent kernel warnings in dmesg or journald.
Alert on unprivileged users generating high volumes of MPTCP socket operations followed by kernel taint events.

Monitoring Recommendations

Forward kernel logs to a central telemetry pipeline and index MPTCP-related tokens for retrospective search.
Track process-level syscall telemetry (execve, socket family, socket protocol) to identify unusual MPTCP usage on servers that do not require it.
Monitor for kernel crash artifacts and reboots on systems with MPTCP enabled.

How to Mitigate CVE-2025-38552

Immediate Actions Required

Apply the kernel updates published by your distribution vendor as soon as they are available.
On Debian, follow the Debian LTS Announcement to update affected packages.
For Siemens products, review the Siemens Security Advisory and apply the recommended firmware updates.
Restrict local shell and container access on multi-tenant hosts until patches are deployed.

Patch Information

The upstream fix is committed to stable kernel branches. Relevant commits include 659da22d, 7c96d519, c476d627, def5b7b2, and f81b6fbe. Update to the latest patched stable release corresponding to your kernel branch.

Workarounds

Disable MPTCP where it is not required by setting net.mptcp.enabled=0 via sysctl.
Block userland from creating MPTCP sockets using seccomp or LSM policies that deny IPPROTO_MPTCP.
Limit which users can execute untrusted code on affected hosts and enforce user namespace restrictions where feasible.

bash

# Disable MPTCP at runtime and persist across reboots
sudo sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf
sudo sysctl --system