Critical Vulnerability in Linux Kernel: mptcp Sysctl Blackhole Timeout Issue
Summary
DEBIAN-CVE-2025-21641: In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: blackhole timeout: avoid using current->nsproxy As mentioned in the previous commit, using the 'net' structure via 'current' is not recom... Affects linux versions < 6.12.10-1. Fixed in 6.12.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It supports various functionalities, including process management, memory management, and networking. The kernel is crucial for system stability and performance, making its security paramount. This specific vulnerability affects the mptcp (Multipath TCP) implementation, which enhances TCP's capabilities by allowing multiple paths for data transmission, improving redundancy and performance.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mptcp implementation related to the sysctl blackhole timeout. The issue arises from the use of 'current->nsproxy' to access network namespace information, which can lead to inconsistencies and potential null pointer dereferences. This can occur when the current task is exiting, resulting in a crash or unexpected behavior. The vulnerability was highlighted by syzbot during testing, emphasizing the need for careful handling of network structures in concurrent environments.
How To Fix
Minimum fixed version
6.12.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any potential risks.
Conclusion
The identified vulnerability in the Linux kernel's mptcp implementation poses significant risks to system stability and security. Users are strongly advised to update their kernel to the patched version 6.12.10-1 to mitigate these risks. Regular monitoring and prompt updates are essential to maintaining a secure operating environment.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a potential null pointer dereference in the mptcp implementation of the Linux kernel, which can lead to system crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failure to address this vulnerability may result in system instability, crashes, and potential exploitation by malicious actors.
Yes, the vulnerability affects versions prior to 6.12.10-1 in both Debian 13 and Debian 14.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as possible to ensure system security.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
