CVE-2023-53088

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) subsystem. An improper cleanup sequence during listener socket shutdown can lead to a use-after-free condition where the kernel accesses socket memory after it has already been released. A local attacker could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system.

A moderate impact use-after-free flaw exists in the Linux kernel's Multipath TCP (MPTCP) subsystem in the listener socket shutdown path. When an MPTCP listener socket is closed, the MPTCP socket grace period can legitimately expire between the last reference count drop in mptcp_subflow_queue_clean() and the later socket access in the TCP listener cleanup path (inet_csk_listen_stop), causing the kernel to access socket memory that has already been freed. A local attacker able to run code on the system could trigger this race condition to crash the kernel, resulting in a denial of service. Red Hat rates this flaw as Moderate (CVSS 5.5, availability impact only), which is lower than the 7.8 severity assigned by NIST and the upstream CVE record, as there is no evidence of confidentiality or integrity impact from this flaw. The vulnerable code was introduced in upstream kernel version 5.19, and Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those releases. Red Hat Enterprise Linux 9 (kernel and kernel-rt packages) is affected; the fix is currently deferred, and the residual risk is limited to a local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.