CVE-2023-54085

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer dereference on fastopen early fallback In case of early fallback to TCP, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated sock to the caller. The fastopen path does not cope with the above unconditionally dereferencing the subflow context.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/95135835519b0ab931c39908b2c99e9fb3c9068b
https://git.kernel.org/stable/c/c0ff6f6da66a7791a32c0234388b1bdc00244917

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-24 13:16

Updated : 2026-08-04 10:19

NVD link : CVE-2023-54085

Mitre link : CVE-2023-54085

CVE.ORG link : CVE-2023-54085

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2023-54085", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408", "lessThan": "95135835519b0ab931c39908b2c99e9fb3c9068b", "versionType": "git"}, {"status": "affected", "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408", "lessThan": "c0ff6f6da66a7791a32c0234388b1bdc00244917", "versionType": "git"}], "programFiles": ["net/mptcp/fastopen.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "semver"}, {"status": "unaffected", "version": "6.2.12", "versionType": "semver", "lessThanOrEqual": "6.2.*"}, {"status": "unaffected", "version": "6.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mptcp/fastopen.c"], "defaultStatus": "affected"}]}], "published": "2025-12-24T13:16:10.357", "references": [{"url": "https://git.kernel.org/stable/c/95135835519b0ab931c39908b2c99e9fb3c9068b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c0ff6f6da66a7791a32c0234388b1bdc00244917", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix NULL pointer dereference on fastopen early fallback\n\nIn case of early fallback to TCP, subflow_syn_recv_sock() deletes\nthe subflow context before returning the newly allocated sock to\nthe caller.\n\nThe fastopen path does not cope with the above unconditionally\ndereferencing the subflow context."}], "lastModified": "2026-08-04T10:19:28.240", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}