CVE-2025-38552
A race condition in the Linux kernel’s Multi‑Protocol Transport Control Protocol (MPTCP) can let an attacker cause the kernel to mishandle subflow creation, potentially leading to crashes or service disruption. The issue has been fixed in newer kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.16 and earlier, including Debian Linux 11.0 users who run those kernels.
Real-world impact
An attacker could trigger the race to crash the kernel or disrupt network connections, resulting in a denial of service for the affected system.
Why this severity
The CVSS score of 9.4 reflects that the flaw can be exploited over the network with no special privileges or user interaction, and it can severely compromise the integrity and availability of the system.
What to do about it
- 01Upgrade the Linux kernel to version 6.16 or later, which includes the patch for the MPTCP race condition.
- 02Restart the system or reload the kernel module to apply the update.
NVD-referenced vendor advisory
Timeline
- Aug 16, 2025 · Aug 16, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/659da22dee5ff316ba…patch
- git.kernel.org/stable/c/7c96d519ee15a13084…patch
- git.kernel.org/stable/c/c476d627584b7589a1…patch
- git.kernel.org/stable/c/def5b7b2643ebba696…patch
- git.kernel.org/stable/c/f81b6fbe13c7fc413b…patch
- lists.debian.org/debian-lts-announce/2025/10…mailing listthird party advisory
- cert-portal.siemens.com/productcert/html/ssa-032379…