CVE-2025-71144: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71144 is a denial-of-service vulnerability in the Linux kernel's MPTCP (MultiPath TCP) implementation caused by improper context reset during socket disconnect operations. It was published on January 14, 2026, and affects Linux kernel versions 6.1.159–6.1.163, 6.12.60–6.12.64, 6.6.119, 6.17.10 through 6.18.4 (including 6.18-rc7 and 6.18 base), and 6.19-rc1 through 6.19-rc3. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), requiring only local access and low privileges to trigger (Feedly, kernel.org patch).

The root cause is a logic flaw (classified as NVD-CWE-noinfo / insufficient information) in the MPTCP disconnect path: when mptcp_disconnect() is called on an MPC subflow already in TCP_CLOSE state or that has fallen back to plain TCP, mptcp_do_fastclose() skips setting the send_fastclose flag, causing __mptcp_close_ssk() to skip resetting the subflow context. Subsequent connections are then created with the request_mptcp flag set but the MSK-level fallback status cleared (it is unconditionally reset at disconnect time), producing an inconsistent state that triggers a kernel WARN_ON in subflow_data_ready() at net/mptcp/subflow.c:1519. The fix introduces an explicit fastclosing flag checked after mptcp_do_fastclose() to ensure proper context reset regardless of subflow state (Feedly, kernel.org patch).

Exploitation of this vulnerability by a low-privileged local user can cause kernel warnings (WARN_ON) in subflow_data_ready(), leading to system instability and potential denial of service. There is no confidentiality or integrity impact — the vulnerability is purely an availability concern, affecting the stability of the Linux networking stack on systems with MPTCP enabled. Repeated triggering could destabilize the kernel, potentially causing crashes on affected systems (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log containing WARNING: CPU: ... at net/mptcp/subflow.c:1519 subflow_data_ready.
• Process: Unusual processes repeatedly creating and disconnecting MPTCP sockets (e.g., fuzzing tools or scripts cycling through socket connect/disconnect operations).
• System: Increased kernel warning counts (/proc/sys/kernel/warn_count) or unexpected system instability correlated with MPTCP socket activity.

Apply the upstream kernel patches available for the affected stable branches: upgrade to kernel 6.1.164 or later, 6.6.119 (patched via stable commit), 6.12.65 or later, or 6.18.5 or later. Specific stable commits addressing this issue include 1c7c3a9314d8, 226fff52e7ed, 5c7c7135468f, 86730ac255b0, and f1a77dfc3b04 (kernel.org patch). Debian has issued DSA-6163-1 and DLA-4499-1 for linux 6.1.164-1, and Ubuntu has released USN-8277-1, USN-8277-2, USN-8310-1, and USN-8374-1 addressing this CVE (Debian LTS, Ubuntu USN-8277-1). As a temporary workaround where patching is not immediately possible, restrict local user access to MPTCP socket operations or disable MPTCP via sysctl net.mptcp.enabled=0 if the feature is not required.

Debian issued security advisories (DSA-6163-1 and DLA-4499-1) and Ubuntu published multiple USN notices (USN-8277-1, USN-8277-2, USN-8310-1, USN-8374-1) addressing this vulnerability as part of broader kernel update batches. Oracle also issued an enterprise kernel advisory (oracle-el-2026-50144). No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution advisories (Debian LTS, Ubuntu USN-8277-1).