CVE-2024-35894 is a vulnerability identified in the Linux kernel's implementation of Multipath TCP (MPTCP), specifically related to Berkeley Packet Filter (BPF) programs accessing socket options improperly. The root cause lies in BPF programs being able to access MPTCP-level proto_ops from the context of a TCP subflow socket, which is an unintended scope. This improper access can lead to a kernel warning or crash (splat), as demonstrated by the reported CPU warning and call trace involving functions such as subflow_data_ready, mptcp_set_rcvlowat, and bpf_sock_ops_setsockopt. The vulnerability arises because BPF programs, which are used for advanced packet filtering and socket operations, can manipulate socket options at a level that should be restricted, potentially leading to instability or denial of service. The fix implemented prevents BPF from accessing the lowat (receive low water mark) option from subflow sockets, effectively blocking the problematic call path and mitigating the risk of kernel crashes or exploitation. No known exploits are currently reported in the wild, and the vulnerability was published shortly after discovery, indicating a proactive patching effort by the Linux kernel maintainers.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with MPTCP enabled and utilizing BPF programs for socket operations. Since MPTCP is used to improve network resilience and throughput by allowing multiple paths for TCP connections, environments relying on this feature—such as telecom infrastructure, cloud providers, and enterprises with advanced networking setups—could experience kernel crashes or denial of service if exploited. The impact includes potential service interruptions, reduced availability of critical network services, and increased operational costs due to system instability. Confidentiality and integrity impacts are less direct but could arise if attackers leverage kernel instability to escalate privileges or disrupt security monitoring tools that rely on BPF. Given the widespread use of Linux in European data centers, cloud environments, and embedded systems, unpatched systems could face operational risks, especially in sectors like finance, telecommunications, and critical infrastructure where uptime and network reliability are paramount.

European organizations should prioritize updating their Linux kernels to versions that include the patch for CVE-2024-35894. Specifically, kernel versions incorporating the fix that restricts BPF access to MPTCP subflow socket options should be deployed. Organizations using custom or long-term support kernels should backport the patch if not already included. Additionally, administrators should audit the use of BPF programs, especially those that manipulate socket options, to ensure they do not inadvertently trigger this vulnerability. Restricting BPF program loading to trusted users and processes can reduce risk. Network teams should monitor kernel logs for warnings related to subflow_data_ready or BPF socket operations, which may indicate attempts to exploit this issue. For environments where MPTCP is not required, disabling it can be a temporary mitigation. Finally, integrating vulnerability management processes to track Linux kernel updates and applying them promptly will reduce exposure.