Junglewise Threat Intelligence

CVE-2026-43252: Linux Kernel MPTCP state inconsistency in path manager

CVE-2026-43252 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation, which is used to improve network performance by using multiple paths simultaneously. A local attacker could trigger a system warning or kernel 'splat' by performing a specific sequence of network configuration actions, such as creating and removing connection endpoints. This issue primarily impacts system stability and could potentially be used to cause a denial-of-service condition.

Technical details

A race or logic error exists in the MPTCP path manager (PM) within the Linux kernel. When an MPTCP endpoint is removed, the kernel failed to set the corresponding ID as available in the 'id_avail_bitmap' for certain endpoint types (specifically those not marked as 'signal' or 'subflow', such as the initial subflow). If a user subsequently recreates an endpoint with the same ID and modifies its flags (e.g., adding 'fullmesh'), it triggers a kernel warning in '__mark_subflow_endp_available' because the ID is still marked as used while the local address count is zero. This is classified as an improper locking or state management issue (CWE-667). Patches have been released across multiple stable kernel branches to ensure the ID is always marked as available upon endpoint removal.

Affected products

  • Linux Linux Kernel 6.1.107 to 6.1.167, 6.6.48 to 6.6.130, 6.10.7 to 6.11, 6.11.1 to 6.12.78, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-05-06: advisory: CVE-2026-43252 published
  • 2026-03-06: patched: Initial patch authored by Matthieu Baerts

References

Related threats