CVE-2022-4128: 
Linux Kernel vulnerability analysis and mitigation

A NULL pointer dereference vulnerability (CVE-2022-4128) was discovered in the Linux kernel's MPTCP protocol when traversing the subflow list at disconnect time. The vulnerability was reported in November 2022 and affects Linux kernel versions up to (excluding) 5.19 (NVD, CVE).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 5.5 (Medium). The issue occurs during the MPTCP protocol's subflow list traversal at disconnect time, where under specific circumstances - such as MPJ subflow and passive MPTCP socket - the operation can remove the subflow from the list, invalidating the current iterator (GitHub Patch, NVD).

A local user could exploit this vulnerability to potentially crash the system, resulting in a denial of service condition. The vulnerability affects the system's availability but does not impact confidentiality or integrity (NVD).

The vulnerability was fixed by implementing a safe list traversing helper variant. The fix was committed to the Linux kernel through commit 5c835bb142d4, which addresses the issue by using listforeachentrysafe instead of the previous unsafe traversal method (GitHub Patch).