CVE-2021-47370: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2021-47370) was discovered in the MPTCP (Multipath TCP) implementation. The issue stems from a signed/unsigned comparison in the expression info->size_goal - skb->len > 0, which evaluates to true when the size goal is smaller than the skb size. This results in a lack of tx cache refill, causing the skb allocated by the core TCP code to lack the required MPTCP skb extensions (Kernel Git).

The vulnerability occurs in the MPTCP protocol implementation where a sign-related comparison issue leads to incorrect behavior. When the size_goal is smaller than the skb size, the expression info->size_goal - skb->len > 0 incorrectly evaluates to true due to signed/unsigned mismatch. This causes the tx cache to not be refilled properly, resulting in missing MPTCP extensions in the allocated skb (Kernel Git).

The vulnerability can trigger a kernel warning (WARN_ON) in the MPTCP implementation, potentially affecting system stability and network operations. The issue specifically manifests in the mptcp_sendmsg_frag function, where the incorrect handling of skb extensions can lead to system warnings (Kernel Git).

The vulnerability was discovered and reported by syzbot, indicating it can be triggered through specific network operations. While a proof-of-concept exists that can trigger the warning condition, no evidence of active exploitation in the wild has been reported (Kernel Git).

The issue has been fixed by rewriting the relevant expression to avoid sign-related problems, noting that size_goal is always >= 0. Additionally, the fix ensures that the skb in the tx cache always carries the relevant extension. The patch has been merged into the Linux kernel (Kernel Git).