{"id":"DEBIAN-CVE-2025-21707","details":"In the Linux kernel, the following vulnerability has been resolved:  mptcp: consolidate suboption status  MPTCP maintains the received sub-options status is the bitmask carrying the received suboptions and in several bitfields carrying per suboption additional info.  Zeroing the bitmask before parsing is not enough to ensure a consistent status, and the MPTCP code has to additionally clear some bitfiled depending on the actually parsed suboption.  The above schema is fragile, and syzbot managed to trigger a path where a relevant bitfield is not cleared/initialized:    BUG: KMSAN: uninit-value in __mptcp_expand_seq net/mptcp/options.c:1030 [inline]   BUG: KMSAN: uninit-value in mptcp_expand_seq net/mptcp/protocol.h:864 [inline]   BUG: KMSAN: uninit-value in ack_update_msk net/mptcp/options.c:1060 [inline]   BUG: KMSAN: uninit-value in mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209    __mptcp_expand_seq net/mptcp/options.c:1030 [inline]    mptcp_expand_seq net/mptcp/protocol.h:864 [inline]    ack_update_msk net/mptcp/options.c:1060 [inline]    mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209    tcp_data_queue+0xb4/0x7be0 net/ipv4/tcp_input.c:5233    tcp_rcv_established+0x1061/0x2510 net/ipv4/tcp_input.c:6264    tcp_v4_do_rcv+0x7f3/0x11a0 net/ipv4/tcp_ipv4.c:1916    tcp_v4_rcv+0x51df/0x5750 net/ipv4/tcp_ipv4.c:2351    ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205    ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233    NF_HOOK include/linux/netfilter.h:314 [inline]    ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254    dst_input include/net/dst.h:460 [inline]    ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:447    NF_HOOK include/linux/netfilter.h:314 [inline]    ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:567    __netif_receive_skb_one_core net/core/dev.c:5704 [inline]    __netif_receive_skb+0x319/0xa00 net/core/dev.c:5817    process_backlog+0x4ad/0xa50 net/core/dev.c:6149    __napi_poll+0xe7/0x980 net/core/dev.c:6902    napi_poll net/core/dev.c:6971 [inline]    net_rx_action+0xa5a/0x19b0 net/core/dev.c:7093    handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561    __do_softirq+0x14/0x1a kernel/softirq.c:595    do_softirq+0x9a/0x100 kernel/softirq.c:462    __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389    local_bh_enable include/linux/bottom_half.h:33 [inline]    rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]    __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4493    dev_queue_xmit include/linux/netdevice.h:3168 [inline]    neigh_hh_output include/net/neighbour.h:523 [inline]    neigh_output include/net/neighbour.h:537 [inline]    ip_finish_output2+0x187c/0x1b70 net/ipv4/ip_output.c:236    __ip_finish_output+0x287/0x810    ip_finish_output+0x4b/0x600 net/ipv4/ip_output.c:324    NF_HOOK_COND include/linux/netfilter.h:303 [inline]    ip_output+0x15f/0x3f0 net/ipv4/ip_output.c:434    dst_output include/net/dst.h:450 [inline]    ip_local_out net/ipv4/ip_output.c:130 [inline]    __ip_queue_xmit+0x1f2a/0x20d0 net/ipv4/ip_output.c:536    ip_queue_xmit+0x60/0x80 net/ipv4/ip_output.c:550    __tcp_transmit_skb+0x3cea/0x4900 net/ipv4/tcp_output.c:1468    tcp_transmit_skb net/ipv4/tcp_output.c:1486 [inline]    tcp_write_xmit+0x3b90/0x9070 net/ipv4/tcp_output.c:2829    __tcp_push_pending_frames+0xc4/0x380 net/ipv4/tcp_output.c:3012    tcp_send_fin+0x9f6/0xf50 net/ipv4/tcp_output.c:3618    __tcp_close+0x140c/0x1550 net/ipv4/tcp.c:3130    __mptcp_close_ssk+0x74e/0x16f0 net/mptcp/protocol.c:2496    mptcp_close_ssk+0x26b/0x2c0 net/mptcp/protocol.c:2550    mptcp_pm_nl_rm_addr_or_subflow+0x635/0xd10 net/mptcp/pm_netlink.c:889    mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:924 [inline]    mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_netlink.c:1688 [inline]    mptcp_nl_flush_addrs_list net/mptcp/pm_netlink.c:1709 [inline]    mptcp_pm_nl_flush_addrs_doit+0xe10/0x1630 net/mptcp/pm_netlink.c:1750    genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]   ---truncated---","modified":"2026-09-01T16:06:09.871128264Z","published":"2025-02-27T02:15:14.347Z","upstream":["CVE-2025-21707"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21707"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.129-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21707.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21707.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21707.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}