CVE-2024-53122

In the Linux kernel, the following vulnerability has been resolved:

mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

Additional active subflows - i.e. created by the in kernel path

manager - are included into the subflow list before starting the

3whs.

A racing recvmsg() spooling data received on an already established

subflow would unconditionally call tcp_cleanup_rbuf() on all the

current subflows, potentially hitting a divide by zero error on

the newly created ones.

Explicitly check that the subflow is in a suitable state before

invoking tcp_cleanup_rbuf().