CVE-2025-68291: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68291 is a divide-by-zero vulnerability in the Linux kernel's MPTCP (Multipath TCP) subsystem, specifically in the mptcp_do_fastclose() function. The flaw occurs because rcv_mss is not initialized before tcp_send_active_reset() is called, causing a divide-by-zero error in __tcp_select_window(). It was disclosed on December 16, 2025, and affects the Linux kernel across multiple distributions including Debian, Ubuntu, and Microsoft Azure Linux 3 (kernel 6.6.119.3-3). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper initialization of the rcv_mss field (CWE-369: Divide By Zero) in the MPTCP fast-close path. When mptcp_do_fastclose() calls tcp_send_active_reset(), the rcv_mss value remains zero, which is subsequently used as a divisor in __tcp_select_window() at net/ipv4/tcp_output.c:3336, triggering a kernel divide-by-zero oops. An analogous bug was previously fixed for bare TCP sockets in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0"); this CVE applies the same fix to the MPTCP code path. The vulnerability was discovered via syzbot fuzzing and requires a local attacker to trigger the MPTCP fast-close path with an uninitialized socket (Red Hat Bugzilla).

Successful exploitation causes a kernel divide-by-zero panic (oops), resulting in a denial of service — the affected system may crash or become unstable. There is no confidentiality or integrity impact; the vulnerability is limited to availability. The scope is confined to the local system, with no known potential for lateral movement or data exfiltration (Red Hat Advisory, Red Hat Bugzilla).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing divide error and a call trace referencing __tcp_select_window, tcp_send_active_reset, mptcp_do_fastclose, and mptcp_disconnect.
• Process: Unexpected kernel panic or system crash triggered by a process using MPTCP sockets (e.g., processes calling sendmsg with MPTCP fast-open followed by fast-close).
• Logs: Presence of Oops: divide error: 0000 [#1] SMP KASAN PTI in kernel logs, with RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 in the stack trace (Red Hat Bugzilla).

Apply the upstream Linux kernel patch that initializes rcv_mss to TCP_MIN_MSS before calling tcp_send_active_reset() in mptcp_do_fastclose(), mirroring the fix from commit 499350a5a6e7. Patches are available in stable kernel trees (commits 05f5e26d488c, 46b8b58f93f1, 88163f85d59b). Distribution-specific updates have been released for Debian (DSA-6127-1, DLA-4476-1), Ubuntu (USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), and Microsoft Azure Linux 3. Users should update to the patched kernel version provided by their distribution as soon as possible. As a temporary workaround, disabling MPTCP on systems where it is not required (sysctl -w net.mptcp.enabled=0) can mitigate exposure (Red Hat Advisory, Red Hat Bugzilla).