Executive brief
A vulnerability was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation that could lead to system instability. The issue involves a data race during network address management, which could potentially be exploited to cause a system crash or unpredictable behavior. This affects systems using MPTCP for optimized network connections.
Technical details
A data race exists in the mptcp_pm_add_timer() helper function within the Linux kernel's MPTCP implementation. This function is executed as a timer callback in softirq context but failed to properly acquire the socket lock using bh_lock_sock(). An attacker with local access could potentially exploit this race condition during ADD_ADDR retransmissions to cause kernel instability or a denial of service. The fix ensures the socket lock is held during the callback and implements a retry mechanism if the socket is currently owned by a user-space process. The vulnerability was addressed in multiple stable branches including fixes in net/mptcp/pm.c and net/mptcp/pm_netlink.c.
Affected products
- Linux Linux Kernel Fixed in versions 5cd6e0ad79d2, 013dcdc19615, 2ad56e434199, 6e4710d7d878, cc3c0399361e
Timeline
- 2026-05-28: advisory: NVD publication date
- 2026-05-06: patched: Initial fix committed to mainline kernel
References
- https://git.kernel.org/stable/c/013dcdc1961543b9a3433466bc8c79a2f4ca75b5
- https://git.kernel.org/stable/c/2ad56e434199ca24a812bb353667aa1c3860f513
- https://git.kernel.org/stable/c/5cd6e0ad79d2615264f63929f8b457ad97ae550d
- https://git.kernel.org/stable/c/6e4710d7d8782cb61af29a7e7111ddfc38b9e1a3
- https://git.kernel.org/stable/c/cc3c0399361efaaf7ae64262eb3f70829b1189c6