CVE-2024-35894

A flaw was found in the Linux kernel's MPTCP (MultiPath Transmission Control Protocol) subsystem. A local user can cause a Denial of Service (DoS) by running a Berkeley Packet Filter (BPF) program that modifies socket options on an active subflow socket. Because the kernel improperly allows BPF programs to access MPTCP-level protocol operations from a subflow context, invoking these operations triggers kernel assertions and can lead to system instability.

This vulnerability is rated as Low severity because exploiting it requires elevated local privileges to load and attach socket-filtering eBPF programs, limiting the blast radius to a denial of service. On Red Hat Enterprise Linux, unprivileged eBPF is disabled by default, meaning an attacker must already possess administrative capabilities such as CAP_BPF or CAP_NET_ADMIN to install the problematic filter. Furthermore, the issue only manifests when specific socket options are manipulated during active Multipath TCP subflow connections, generating a non-fatal kernel warning rather than arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.