Executive brief
A vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation can cause a system crash or kernel panic. MPTCP is a networking feature that allows a single data connection to use multiple network paths simultaneously for better performance and reliability. An attacker with local access could trigger this issue by manipulating network connection settings, potentially leading to a denial-of-service condition that disrupts operations.
Technical details
A logic error exists in the MPTCP Path Manager (PM) within the Linux kernel when handling endpoints configured with both 'signal' and 'subflow' flags. When the subflow limit is set to zero, the kernel may clear a bit in the ID availability bitmap without incrementing the local address usage counter. This inconsistency triggers a kernel warning (splat) in `__mark_subflow_endp_available` during endpoint removal because the function expects the usage counter to be non-zero if the bitmap indicates the ID was used. The vulnerability can be triggered locally via crafted Netlink messages to manipulate MPTCP endpoints. Patches have been released for various stable kernel branches to ensure the usage counter is correctly incremented even when subflow creation is restricted by limits.
Affected products
- Linux Linux Kernel 6.19.0-08368-gfafda3b4b06b
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-03-03: patched: Initial patch submitted by Matthieu Baerts
- 2026-03-25: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/05799c2f1ca5eb13d65764dda688d02021b65e06
- https://git.kernel.org/stable/c/198824ccfa64ffebd918bf99c939bd8170a4a4d8
- https://git.kernel.org/stable/c/579a752464a64cb5f9139102f0e6b90a1f595ceb
- https://git.kernel.org/stable/c/67f34ab318807989b57dfdb0f79e2d4e57018290
- https://git.kernel.org/stable/c/a64aa7db39392add5be09dffaedbf1f0ce5554df
- https://git.kernel.org/stable/c/c5c877e140e5f46023a74a51e577ce5edd0a4be7
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html