CVE-2021-47594 is a vulnerability in the Linux kernel's implementation of Multipath TCP (MPTCP), specifically related to the path manager (PM) component. The flaw arises because when an endpoint is deleted, the netlink PM traverses all local MPTCP sockets without filtering by their status. Consequently, if an MPTCP listener socket is bound to the IP address of the deleted endpoint, the listener TCP socket is erroneously closed. This behavior is unintended since the PM should only affect data subflows, not listener sockets. This improper handling can lead to unexpected socket closures, disrupting network connections relying on MPTCP. Additionally, the vulnerability can cause a NULL pointer dereference, as demonstrated by syzbot (a kernel fuzzing tool), leading to a general protection fault and kernel crash. The root cause is the failure to explicitly skip MPTCP sockets in the TCP_LISTEN state during endpoint deletion. The vulnerability affects Linux kernel versions prior to the patch that fixes this logic by excluding listener sockets from closure. The issue can cause denial of service (DoS) conditions due to kernel crashes or unexpected socket closures, impacting systems using MPTCP for network communication. The vulnerability does not require user interaction or authentication to be triggered if an attacker can influence endpoint deletion or socket binding. No known exploits are reported in the wild as of the publication date. The technical details include kernel stack traces showing the NULL pointer dereference in kernel locking code during socket operations, highlighting the severity of the crash. This vulnerability is relevant to Linux systems with MPTCP enabled or in use, which is increasingly common in environments requiring resilient or multipath network connections.

For European organizations, this vulnerability poses a risk primarily to servers and network infrastructure running Linux kernels with MPTCP enabled. Organizations relying on MPTCP for load balancing, redundancy, or improved network throughput could experience unexpected service disruptions due to listener socket closures or kernel crashes. This can affect critical services such as web servers, application servers, and network appliances, leading to denial of service and potential operational downtime. The impact on confidentiality and integrity is limited since the vulnerability primarily causes availability issues. However, availability disruptions in critical infrastructure or cloud services can have cascading effects on business operations and service delivery. Given the widespread use of Linux in European data centers, cloud providers, and enterprise environments, the vulnerability could affect a broad range of sectors including finance, telecommunications, healthcare, and government. The lack of known exploits reduces immediate risk, but the potential for kernel panics and service outages necessitates prompt mitigation. The vulnerability could also be leveraged in targeted attacks to disrupt services or as part of a larger attack chain.

European organizations should take the following specific mitigation steps: 1) Identify Linux systems running kernels with MPTCP enabled, especially those in critical network roles or exposed to untrusted networks. 2) Apply the latest Linux kernel patches that explicitly fix this vulnerability by skipping MPTCP listener sockets during endpoint deletion. If vendor-specific kernel updates are not yet available, consider disabling MPTCP functionality temporarily to prevent exploitation. 3) Monitor kernel logs for signs of NULL pointer dereferences or unexpected socket closures related to MPTCP. 4) Implement network segmentation and strict access controls to limit the ability of untrusted users or processes to manipulate MPTCP endpoints or sockets. 5) Use kernel hardening features such as Kernel Address Sanitizer (KASAN) and lock debugging to detect and analyze potential kernel faults early. 6) Incorporate this vulnerability into vulnerability management and incident response plans to ensure rapid detection and remediation. 7) Coordinate with Linux distribution vendors and cloud providers to ensure timely patch deployment. These measures go beyond generic advice by focusing on MPTCP-specific configurations and kernel-level monitoring.