---
id: CVE-2023-54085
title: 'mptcp: fix NULL pointer dereference on fastopen early fallback'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mptcp: fix NULL pointer dereference on fastopen early fallback

  In case of early fallback to TCP, subflow_syn_recv_sock() deletes
  the subflow context before returning t…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 36b122baf6a8bd46b4a591f12f4ed17b22257408 <
    95135835519b0ab931c39908b2c99e9fb3c9068b
  - >-
    Linux >= 36b122baf6a8bd46b4a591f12f4ed17b22257408 <
    c0ff6f6da66a7791a32c0234388b1bdc00244917
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:38:15.912200Z'
published: '2025-12-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:39.088Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-54085'
references:
  - url: 'https://git.kernel.org/stable/c/95135835519b0ab931c39908b2c99e9fb3c9068b'
  - url: 'https://git.kernel.org/stable/c/c0ff6f6da66a7791a32c0234388b1bdc00244917'
tags:
  - cve.org
epss: 0.0043
epssPercentile: 0.35652
ingestedAt: '2026-10-15T22:48:25.428Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix NULL pointer dereference on fastopen early fallback

In case of early fallback to TCP, subflow_syn_recv_sock() deletes
the subflow context before returning the newly allocated sock to
the caller.

The fastopen path does not cope with the above unconditionally
dereferencing the subflow context.

## Affected

- `Linux >= 36b122baf6a8bd46b4a591f12f4ed17b22257408 < 95135835519b0ab931c39908b2c99e9fb3c9068b`
- `Linux >= 36b122baf6a8bd46b4a591f12f4ed17b22257408 < c0ff6f6da66a7791a32c0234388b1bdc00244917`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.