CVE-2025-68291: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68291 is a divide-by-zero vulnerability in the Linux kernel's MPTCP (Multipath TCP) subsystem, specifically in the mptcp_do_fastclose() function. The flaw occurs because rcv_mss is not initialized before tcp_send_active_reset() is called, causing a divide-by-zero error in __tcp_select_window(). It was disclosed on December 16, 2025, and affects the Linux kernel across multiple distributions including Debian, Ubuntu, and Microsoft Azure Linux 3 (kernel 6.6.119.3-3). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper initialization of the rcv_mss field (CWE-369: Divide By Zero) in the MPTCP fast-close path. When mptcp_do_fastclose() calls tcp_send_active_reset(), the rcv_mss value remains zero, which is subsequently used as a divisor in __tcp_select_window() at net/ipv4/tcp_output.c:3336, triggering a kernel divide-by-zero oops. An analogous bug was previously fixed for bare TCP sockets in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0"); this CVE applies the same fix to the MPTCP code path. The vulnerability was discovered via syzbot fuzzing and requires a local attacker to trigger the MPTCP fast-close path with an uninitialized socket (Red Hat Bugzilla).

Successful exploitation causes a kernel divide-by-zero panic (oops), resulting in a denial of service — the affected system may crash or become unstable. There is no confidentiality or integrity impact; the vulnerability is limited to availability. The scope is confined to the local system, with no known potential for lateral movement or data exfiltration (Red Hat Advisory, Red Hat Bugzilla).

No public exploit code or weaponized proof-of-concept is known at this time. The vulnerability is locally exploitable and requires low privileges (PR:L), with no user interaction needed. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term (Red Hat Advisory).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing divide error and a call trace referencing __tcp_select_window, tcp_send_active_reset, mptcp_do_fastclose, and mptcp_disconnect.
• Process: Unexpected kernel panic or system crash triggered by a process using MPTCP sockets (e.g., processes calling sendmsg with MPTCP fast-open followed by fast-close).
• Logs: Presence of Oops: divide error: 0000 [#1] SMP KASAN PTI in kernel logs, with RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 in the stack trace (Red Hat Bugzilla).

Apply the upstream Linux kernel patch that initializes rcv_mss to TCP_MIN_MSS before calling tcp_send_active_reset() in mptcp_do_fastclose(), mirroring the fix from commit 499350a5a6e7. Patches are available in stable kernel trees (commits 05f5e26d488c, 46b8b58f93f1, 88163f85d59b). Distribution-specific updates have been released for Debian (DSA-6127-1, DLA-4476-1), Ubuntu (USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), and Microsoft Azure Linux 3. Users should update to the patched kernel version provided by their distribution as soon as possible. As a temporary workaround, disabling MPTCP on systems where it is not required (sysctl -w net.mptcp.enabled=0) can mitigate exposure (Red Hat Advisory, Red Hat Bugzilla).