DEBIAN-CVE-2024-35894

In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent BPF accessing lowat from a subflow socket. Alexei reported the following splat: WARNING: CPU: 32 PID: 3276 at net/mptcp/subflow.c:1430 subflowdataready+0x147/0x1c0 Modules linked in: dummy bpftestmod(O) [last unloaded: bpftestnocfi(O)] CPU: 32 PID: 3276 Comm: testprogs Tainted: GO 6.8.0-12873-g2c43c33bfd23 Call Trace: <TASK> mptcpsetrcvlowat+0x79/0x1d0 sksetsockopt+0x6c0/0x1540 _bpfsetsockopt+0x6f/0x90 bpfsockopssetsockopt+0x3c/0x90 bpfprog509ce5db2c7f9981bpftestsockoptint+0xb4/0x11b bpfprogdce07e362d941d2bbpftestsocketsockopt+0x12b/0x132 bpfprog348c9b5faaf10092skopssockopt+0x954/0xe86 _cgroupbpfrunfiltersockops+0xbc/0x250 tcpconnect+0x879/0x1160 tcpv6connect+0x50c/0x870 mptcpconnect+0x129/0x280 _inetstreamconnect+0xce/0x370 inetstreamconnect+0x36/0x50 bpftrampoline6442491565+0x49/0xef inetstreamconnect+0x5/0x50 _sysconnect+0x63/0x90 _x64sysconnect+0x14/0x20 The root cause of the issue is that bpf allows accessing mptcp-level protoops from a tcp subflow scope. Fix the issue detecting the problematic call and preventing any action.