Threats tagged 'ghsa-q4wq-g3wm-gmfc'

A critical race condition vulnerability in the Linux kernel's multipath TCP (mptcp) implementation was resolved. The function mptcp_pm_del_add_timer() could call sk_stop_timer_sync() on a timer entry that might have already been freed by another thread, leading to a use-after-free condition. This issue was detected by syzbot and fixed by adding RCU protection to prevent concurrent access to freed memory. The vulnerability could result in kernel memory corruption and potentially allow an attacker to cause denial of service or escalate privileges.