CVE-2021-47590 is a vulnerability identified in the Linux kernel's implementation of Multipath TCP (MPTCP), specifically within the __mptcp_push_pending() function. MPTCP is an extension of the traditional TCP protocol that allows a single TCP connection to use multiple paths to maximize resource usage and increase redundancy. The vulnerability arises due to a potential deadlock condition when __mptcp_push_pending() calls mptcp_flush_join_list() while holding a subflow socket lock. If this call triggers mptcp_sockopt_sync_all(), which subsequently invokes __mptcp_sockopt_sync(), the latter may attempt to acquire the same subflow socket lock again, leading to a deadlock. This deadlock can cause the affected process or kernel thread to hang indefinitely, impacting system responsiveness and potentially leading to denial of service (DoS) conditions. The issue was addressed by modifying __mptcp_push_pending() to use __mptcp_flush_join_list() instead of the plain mptcp_flush_join_list(), deferring the socket option synchronization to a workqueue, thereby avoiding the lock contention and deadlock scenario. The vulnerability does not appear to have known exploits in the wild and affects specific Linux kernel versions identified by commit hashes. No CVSS score has been assigned yet, but the technical details and patching approach indicate a concurrency and synchronization flaw within the kernel's networking stack.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions with MPTCP enabled or in use. The deadlock can cause critical network services relying on MPTCP to become unresponsive, potentially disrupting applications that depend on high availability and network redundancy, such as cloud services, telecommunications infrastructure, and enterprise networking solutions. Organizations utilizing Linux-based servers, especially those in telecommunications, cloud providers, and data centers, may experience service degradation or outages if the deadlock is triggered. While the vulnerability does not directly lead to privilege escalation or data leakage, the denial of service impact can affect business continuity and operational stability. Given the widespread use of Linux in European IT infrastructure, particularly in sectors like finance, government, and critical infrastructure, the vulnerability could have a broad operational impact if exploited or triggered inadvertently.

To mitigate this vulnerability, European organizations should: 1) Identify and inventory Linux systems running kernel versions affected by CVE-2021-47590, focusing on those with MPTCP enabled or in use. 2) Apply the official Linux kernel patches that address this deadlock issue as soon as they become available, or upgrade to a kernel version that includes the fix. 3) If immediate patching is not feasible, consider disabling MPTCP functionality temporarily to prevent the deadlock scenario, understanding the trade-offs in network performance and redundancy. 4) Monitor system logs and kernel messages for signs of deadlocks or hangs related to MPTCP socket operations. 5) Implement robust system and network monitoring to detect unusual service interruptions that could indicate triggering of this vulnerability. 6) Engage with Linux distribution vendors for backported patches and security advisories relevant to their specific kernel versions. These steps go beyond generic advice by focusing on MPTCP-specific configurations and kernel-level patch management.