CVE-2025-68221: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68221 is a logic error vulnerability in the Linux kernel's MPTCP (Multipath TCP) subsystem, specifically in the mptcp_pm_nl_rm_addr function. The flaw involves an inverted WARN_ON_ONCE condition that prevents normal address removal counter updates from executing: the decrement logic only runs when the counter is already 0 (an abnormal state), while legitimate removals (counter > 0) are silently ignored. It was published on December 16, 2025, and affects Linux kernel versions in the range introduced by commit 63611391850850bf27f81afb0d0b6d1237a34006 up to the fixes applied in 6.17.10 and 6.18. The CVSS base score is estimated as Medium by Feedly; ENISA records a base score of 0.0, suggesting the vulnerability has not yet received a formal CVSS rating (Feedly, ENISA EUVD).

The root cause is a logic inversion bug (CWE-670: Always-Incorrect Control Flow Implementation) in the MPTCP path manager's address removal routine within net/mptcp/pm_netlink.c. The WARN_ON_ONCE macro is used with an inverted condition, causing the counter decrement to execute only when the address removal counter is already at 0 — the exact opposite of the intended behavior. As a result, normal address removals (where the counter is greater than 0) do not decrement the counter, leading to counter state corruption in the MPTCP path manager. Exploitation would require local access or the ability to trigger MPTCP address removal operations on an affected system. The fix was applied via two stable kernel commits: f7d953c38245c0e9d8e268fb6a9e524602fb44ec and 92e239e36d600002559074994a545fcfac9afd2d (Feedly, ENISA EUVD).

The vulnerability causes incorrect tracking of MPTCP address removal counters, which can lead to inconsistent internal state within the kernel's MPTCP path manager. This may result in unexpected behavior during MPTCP session management, potential resource mismanagement, or triggering of abnormal code paths (e.g., spurious WARN_ON_ONCE triggers). The impact is primarily on availability and integrity of MPTCP networking functionality; there is no known direct path to privilege escalation or remote code execution based on available information (Feedly).

The vulnerability is fixed in Linux kernel versions 6.17.10 and 6.18, via commits f7d953c38245c0e9d8e268fb6a9e524602fb44ec (for the 6.17.x stable branch) and 92e239e36d600002559074994a545fcfac9afd2d (for the 6.18 branch). Ubuntu has issued multiple security notices addressing this CVE: USN-8094-1 through USN-8094-5, and USN-8152-1. Users should update to a patched kernel version provided by their Linux distribution. As a workaround, disabling MPTCP if not required (sysctl -w net.mptcp.enabled=0) may reduce exposure, though upgrading is the recommended remediation (Ubuntu USN-8094-1, Ubuntu USN-8152-1, ENISA EUVD).

Coverage has been limited to standard Linux security advisory channels. Ubuntu issued a series of security notices (USN-8094-1 through USN-8094-5, and USN-8152-1) addressing this and related kernel vulnerabilities. Pro-Linux.de and LinuxSecurity.com covered the Ubuntu advisories. No notable researcher commentary or broader media coverage specific to this CVE has been identified (Ubuntu USN-8094-1, LinuxSecurity).