CVE-2025-23145 is a vulnerability identified in the Linux kernel's implementation of Multipath TCP (MPTCP), specifically in the function mptcp_can_accept_new_subflow. The issue arises due to a NULL pointer dereference caused by a race condition when handling incoming SYN-ACK packets for establishing new subflows. In certain scenarios, the same subflow request (subflow_req) receives two SYN-ACK packets in rapid succession, possibly due to client retransmissions or network conditions. Because these packets can be processed concurrently on different CPUs, the ownership of the subflow_req->msk (multipath socket) can be transferred prematurely to the first subflow, leaving the second processing thread with a NULL pointer reference. This results in a kernel panic, effectively causing a denial of service (DoS) by crashing the kernel. The patch for this vulnerability involves moving the assignment of subflow_req->msk under a conditional check (own_req == true), ensuring that the pointer is only accessed when valid. Additionally, redundant NULL checks in subflow_hmac_valid() were removed to streamline the code. This vulnerability affects Linux kernel versions containing the specified commit hash 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 and likely other versions with similar MPTCP implementations. No known exploits are reported in the wild as of the publication date, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with MPTCP enabled and exposed to network traffic that could trigger the race condition. The impact is a denial of service through kernel panic, which can cause system crashes and downtime. This is particularly critical for servers and network infrastructure devices that rely on MPTCP for improved network resilience and throughput, such as data centers, cloud service providers, telecom operators, and enterprises with multi-homed network configurations. The DoS could disrupt critical services, leading to operational interruptions and potential financial losses. While the vulnerability does not directly lead to privilege escalation or data leakage, the availability impact is significant. Since exploitation requires sending crafted network packets to the vulnerable system, externally facing Linux servers and network appliances are at higher risk. The absence of known exploits suggests limited immediate threat, but the potential for DoS in high-availability environments remains a concern.

European organizations should prioritize updating their Linux kernel to the patched version that addresses CVE-2025-23145. Specifically, kernel versions incorporating the fix that moves subflow_req->msk assignment under the own_req conditional should be deployed. For environments where immediate patching is not feasible, network-level mitigations can be applied, such as filtering or rate-limiting SYN-ACK packets that may trigger the race condition, especially from untrusted or external sources. Disabling MPTCP on systems where it is not required can also reduce the attack surface. Monitoring kernel logs for mptcp_can_accept_new_subflow related panics or crashes can help detect potential exploitation attempts. Additionally, organizations should implement robust network segmentation and intrusion detection systems to identify anomalous traffic patterns indicative of exploitation attempts. Coordination with Linux distribution vendors for timely patch releases and applying security updates promptly is essential to mitigate this vulnerability effectively.