CVE-2025-21875: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21875 affects the Linux kernel's MPTCP (Multipath TCP) implementation, specifically related to address removal handling under MSK socket lock. The vulnerability was discovered on March 27, 2025, when Syzkaller reported a lockdep splat in the PM control path (NVD).

The vulnerability manifests as a race condition where the PM (Path Manager) can attempt to send a RMADDR over an MSK socket without first acquiring the MSK socket lock. This issue stems from an optimization where RMADDR notifications were not sent when there were no subflows. However, this optimization proved problematic as without proper locks, another process could cause concurrent access issues (NVD).

The vulnerability could lead to race conditions in the MPTCP implementation, potentially affecting network stability and reliability. The issue specifically impacts the address removal functionality in the MPTCP path management system (NVD).

The vulnerability has been resolved in the Linux kernel by ensuring proper handling of address removal under MSK socket lock. The fix involves correcting the assumption about RM_ADDR notifications when there are no subflows (NVD).