CVE-2023-54176: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54176 is a divide-by-zero vulnerability in the Linux kernel's MPTCP (Multipath TCP) subsystem, specifically in the mptcp_worker function. The flaw occurs when the MPTCP worker runs against an msk socket in an unexpected state — for example, after a connect() is followed by an incoming reset and fastclose, then mptcp_disconnect() closes the socket, and a subsequent listen() call leaves the socket in a CLOSED state before mptcp_worker() executes. The vulnerability was published on December 30, 2025, and affects the Linux kernel. Feedly estimates the severity as MEDIUM, with an EPSS score of 0.00018 (Feedly, VulDB).

The root cause is insufficient state validation in mptcp_worker() before it proceeds with TCP window calculations, classified as CWE-369 (Divide By Zero). When the MPTCP worker is scheduled and then executes after the socket has transitioned to the CLOSED state (via mptcp_disconnect()), it calls __tcp_select_window() in net/ipv4/tcp_output.c with invalid state, triggering a divide-by-zero error. The fix involves adding stricter state checks in mptcp_worker to abort processing when the socket is in an unexpected state. The issue was originally reported by Christoph and patches were committed to the stable kernel tree (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful triggering of this vulnerability causes a kernel divide-by-zero panic (oops), resulting in a denial of service — the affected system crashes or becomes unresponsive. The crash occurs in kernel context (workqueue events mptcp_worker), meaning it affects the entire system rather than a single process. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss (Feedly).

Apply the upstream Linux kernel patches that introduce stricter state checks in mptcp_worker. Fixes have been committed to the stable kernel tree across multiple stable branches (commits 19ea79e87af3, aff9099e9c51, d6a0443733434, and f0b4a4086cf2). Users should update to a patched kernel version as provided by their Linux distribution. As a temporary workaround, disabling MPTCP (if not required) via sysctl net.mptcp.enabled=0 can prevent exposure to this code path (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3, Kernel Patch 4).