CVE-2024-53047 is a vulnerability identified in the Linux kernel's implementation of Multipath TCP (MPTCP), specifically within the scheduling component of the MPTCP subsystem. The issue arises due to improper use of Read-Copy-Update (RCU) synchronization primitives. When the kernel is compiled with CONFIG_PROVE_RCU_LIST and its dependency CONFIG_RCU_EXPERT enabled, creating an MPTCP socket triggers a kernel warning indicating suspicious RCU usage. The root cause is that the function mptcp_sched_find() traverses an RCU-protected list without holding the necessary rcu_read_lock(), violating RCU usage rules. This leads to a kernel warning (splat) and potential instability. The problem occurs during socket initialization in the mptcp_init_sock() function, where the missing rcu_read_lock()/rcu_read_unlock() calls cause the kernel's lock dependency checker to flag an error. Although this vulnerability does not appear to have an associated CVSS score or known exploits in the wild, it represents a kernel-level synchronization bug that could lead to kernel crashes or undefined behavior when MPTCP sockets are created under specific kernel configurations. The fix involves adding the missing RCU read-side critical section locks around the list traversal to ensure proper synchronization and prevent the warning and potential instability.

For European organizations, the impact of CVE-2024-53047 primarily concerns systems running Linux kernels with MPTCP enabled and compiled with the debugging options CONFIG_PROVE_RCU_LIST and CONFIG_RCU_EXPERT. While these kernel options are typically used in development or debugging environments rather than production, any deployment of such kernels in critical infrastructure, cloud services, or enterprise servers could experience kernel panics or instability when MPTCP sockets are created. This could lead to denial of service conditions affecting network connectivity or application availability. Given the Linux kernel's widespread use across European governments, enterprises, and cloud providers, any instability at the kernel level can have cascading effects on service reliability. However, since the vulnerability requires specific kernel configurations and no known exploits exist, the immediate risk is limited. Nonetheless, organizations using MPTCP for advanced networking or load balancing should be aware of this issue and apply patches promptly to maintain kernel stability and avoid potential disruptions.

1. Apply the official Linux kernel patches that add the missing rcu_read_lock()/rcu_read_unlock() calls in the MPTCP scheduler code to ensure proper RCU synchronization. 2. Review kernel build configurations and avoid enabling CONFIG_PROVE_RCU_LIST and CONFIG_RCU_EXPERT in production environments unless necessary for debugging, as these options increase sensitivity to RCU misuse. 3. For environments requiring MPTCP, validate kernel stability by testing socket creation and network operations under the patched kernel before deployment. 4. Monitor kernel logs for RCU warnings or splats related to MPTCP to detect any residual issues. 5. Coordinate with Linux distribution maintainers to ensure timely distribution of patched kernel packages. 6. If custom kernels are used, integrate the fix from the upstream Linux kernel source to prevent this vulnerability. 7. Implement robust kernel crash recovery and monitoring mechanisms to minimize downtime in case of unexpected kernel faults.