CVE-2023-54085: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54085 is a NULL pointer dereference vulnerability in the Linux kernel's Multipath TCP (MPTCP) subsystem, specifically in the fastopen early fallback mechanism. When an early fallback to TCP occurs, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated socket to the caller, but the fastopen path unconditionally dereferences the (now-deleted) subflow context, triggering a NULL pointer dereference. The vulnerability affects Linux kernel versions in the range 36b122baf6a8bd46b4a591f12f4ed17b22257408 through c0ff6f6da66a7791a32c0234388b1bdc00244917 (main) and through 95135835519b0ab931c39908b2c99e9fb3c9068b (stable), with patches available for kernel 6.2.12 and 6.3. It was publicly disclosed on December 24, 2025, and carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in the MPTCP subsystem's subflow_syn_recv_sock() function. During an early fallback from MPTCP to standard TCP, this function deletes the subflow context prior to returning the newly allocated socket; the fastopen code path then unconditionally attempts to dereference that already-freed subflow context, resulting in a kernel NULL pointer dereference. Exploitation requires local access with low privileges (PR:L) and high attack complexity (AC:H), as the attacker must trigger the specific MPTCP fastopen fallback code path. The fix is tracked in upstream kernel commits 95135835519b0ab931c39908b2c99e9fb3c9068b and c0ff6f6da66a7791a32c0234388b1bdc00244917 (Red Hat Bugzilla, ENISA EUVD).

Successful exploitation can cause kernel crashes (denial of service) due to the NULL pointer dereference, and in more severe scenarios may allow a local low-privileged attacker to achieve arbitrary code execution within the kernel context. The CVSS assessment assigns high impacts to confidentiality, integrity, and availability, meaning a successful exploit could result in full system compromise, data exposure, and service disruption. The scope is limited to the affected host (S:U), but kernel-level compromise could enable privilege escalation and lateral movement within a multi-tenant or containerized environment (Red Hat Advisory, Red Hat Bugzilla).

Apply the upstream Linux kernel patches: commit 95135835519b0ab931c39908b2c99e9fb3c9068b (stable branch) or c0ff6f6da66a7791a32c0234388b1bdc00244917 (main branch), which correspond to patched versions 6.2.12 and 6.3 respectively. Users should update their kernel via official distribution channels (e.g., Red Hat, Ubuntu, Debian) as vendor-specific packages become available. As a workaround, restricting local user access and disabling MPTCP if not required (sysctl -w net.mptcp.enabled=0) can reduce exposure until a patch is applied (Red Hat Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via its Security Response team and assigned it medium severity in its Bugzilla system, with the upstream advisory referenced from the Linux kernel CVE announcement mailing list (Red Hat Bugzilla). No significant broader community discussion or media coverage has been identified at this time.