Remotely exploitable use-after-free found in Linux multipath TCP stack

Anthropic disclosed a critical use-after-free vulnerability in the Linux kernel's multipath TCP (MPTCP) implementation on October 27. The bug occurs when a retransmitted SYN packet response races against TCP connection establishment in a separate thread, causing one thread to access an options structure that another thread has already freed. This enables kernel memory disclosure or buffer overflow with attacker-controlled data. The Go security team subsequently warned that Go programs enable multipath TCP by default, potentially exposing numerous systems without administrators' knowledge.

The kernel fix delays freeing the affected structure until after an RCU grace period completes, eliminating the race window. No specific kernel version numbers or CVE identifiers were provided in the disclosure. The vulnerability affects any Linux system with MPTCP listeners exposed, regardless of hardware architecture, and patches are expected through distribution channels.

Race condition mechanics and fix

• Trigger condition: The bug activates when a response to a retransmitted SYN packet collides with TCP connection establishment occurring simultaneously in a different thread.
• Memory corruption path: The racing thread accesses the connection's options structure after it has been freed, enabling either kernel memory disclosure or buffer overflow with attacker-controlled payload data.
• Synchronization fix: Developers resolved the issue by deferring the structure's deallocation until after an RCU grace period elapses, ensuring no concurrent readers remain.
• Default exposure surface: Go applications automatically use multipath TCP, expanding the vulnerable population beyond systems with explicit MPTCP configuration.
• Broader concern: The disclosure notes potential for related bugs elsewhere in the TCP stack, suggesting continued scrutiny of networking subsystems is warranted.

Why it matters

Linux distribution maintainers must prioritize backporting this fix across supported kernel branches, as MPTCP exposure through Go applications creates a larger attack surface than typical kernel networking bugs. System administrators should audit whether their systems accept inbound connections through Go-based services and apply kernel updates immediately upon availability, since the vulnerability is remotely exploitable without authentication.