CVE-2022-49669 is a high-severity vulnerability in the Linux kernel's implementation of Multipath TCP (MPTCP). The flaw arises from a race condition involving unaccepted MPTCP subflow sockets when the listener socket is closed. Specifically, when the listener socket owning a connection request is closed, it frees the unaccepted subflows, which leads to the deletion of paired MPTCP sockets. However, the MPTCP socket's worker thread can still run during the interval between these delete operations. If this occurs, any access to the msk->first field results in a Use-after-Free (UaF) error because the subflow cleanup does not clear this pointer in the MPTCP socket. This UaF can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service by crashing the kernel. The fix involves explicitly traversing the listener socket's accept queue during close operations and performing proper cleanup on pending MPTCP sockets, with careful locking to avoid deadlocks—specifically acquiring the MPTCP socket lock while holding the subflow socket lock. The vulnerability is tracked under CWE-416 (Use After Free) and has a CVSS 3.1 base score of 7.8, indicating high severity. Exploitation requires local privileges (AV:L), low attack complexity (AC:L), and privileges (PR:L), but no user interaction (UI:N). No known exploits are currently reported in the wild.

For European organizations, this vulnerability poses a significant risk, especially for those running Linux-based servers or infrastructure that utilize MPTCP for network redundancy and performance improvements. Successful exploitation could lead to kernel crashes, causing denial of service, or potentially privilege escalation through arbitrary code execution in kernel space. This can disrupt critical services, including web servers, cloud infrastructure, and network appliances. Given the widespread use of Linux in European data centers, telecom infrastructure, and government systems, the impact could be substantial. Organizations relying on MPTCP-enabled kernels may face increased risk of service outages or compromise of sensitive data. The vulnerability's local attack vector means that attackers would need some level of access to the system, but insider threats or attackers who have gained limited access could leverage this flaw to escalate privileges or disrupt operations.

European organizations should prioritize patching Linux kernels to versions that include the fix for CVE-2022-49669. Since the vulnerability involves complex locking and socket cleanup logic, relying on vendor-supplied kernel updates is essential rather than attempting manual mitigations. Additionally, organizations should audit and restrict local user privileges to minimize the risk of exploitation by low-privileged users. Network segmentation and strict access controls can reduce the likelihood of attackers gaining local access. Monitoring kernel logs for unusual socket errors or crashes related to MPTCP may help detect exploitation attempts. For environments where immediate patching is not feasible, disabling MPTCP functionality temporarily can mitigate the risk, though this may impact network performance. Finally, maintain up-to-date intrusion detection systems tuned to detect anomalies in kernel behavior or socket operations.