Executive brief
A vulnerability in the Linux kernel's MultiPath TCP (MPTCP) implementation could allow a remote attacker to crash the system. MPTCP is a networking technology that allows data to be sent over multiple paths simultaneously to improve performance. Under specific network conditions involving out-of-order data packets, a race condition can trigger a 'divide by zero' error, leading to a system crash (Oops) and a denial of service.
Technical details
A vulnerability exists in the MPTCP protocol implementation within the Linux kernel due to improper accounting of out-of-order (OoO) packets in the mptcp_rcvbuf_grow() function. When multiple subflows are active, a race condition can occur during receive space initialization while user-space holds the socket lock. If out-of-order data reaches the receive buffer during this window, it can trigger a divide-by-zero exception (Oops), resulting in a kernel panic. The fix involves removing the unnecessary OoO accounting in mptcp_rcvbuf_grow(), as subflows already handle TCP-level out-of-order data independently. Patches have been applied to various stable branches including 6.1.y and 6.6.y.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.7+
Timeline
- 2026-02-03: patched: Initial fix authored by Paolo Abeni
- 2026-05-27: disclosed: CVE published in NVD dataset