Security tracker / CVE-2025-68291

CVE-2025-68291

mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in ae155060247b ("mptcp: fix duplicate reset on fastclose").
 carnil> Vulnerable versions: 6.1.159 6.6.119 6.12.60 6.17.10 6.18.

Bugs

Status

Branch	Status
upstream	released (6.18) [f07f4ea53e22429c84b20832fa098b5ecc0d4e35]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	released (6.17.11) [88163f85d59b4164884df900ee171720fd26686b]
6.12-upstream-stable	released (6.12.61) [05f5e26d488cdc7abc2a826cf1071782d5a21203]
6.6-upstream-stable	needed
6.1-upstream-stable	needed
5.10-upstream-stable	N/A "Vulnerable code not present"
sid	released (6.17.11-1)
6.12-trixie-security	N/A "Vulnerable code not present"
6.1-bookworm-security	N/A "Vulnerable code not present"
5.10-bullseye-security	N/A "Vulnerable code not present"