Executive brief
A vulnerability was identified in the Linux kernel's implementation of MultiPath TCP (MPTCP), a technology that allows devices to use multiple network paths simultaneously for better performance and reliability. A race condition in how the system calculates network window sizes could lead to inconsistent data being sent to other computers on the network. This inconsistency can confuse connected devices, potentially leading to degraded network performance or disrupted connections.
Technical details
A race condition exists in the MPTCP output path (net/mptcp/options.c) due to lockless access of the MPTCP-level ack_seq. The vulnerability occurs because the kernel may use different values for the data_ack in the Data Sequence Signal (DSS) option and the announced receive window (rcv_wnd) calculation for the same egress packet. This TOCTOU flaw can cause protocol inconsistencies that confuse the remote peer. The fix refactors the code to ensure a consistent ack_seq value is used for both the DSS option and the window update, and ensures the receive window is only updated when the packet contains a DSS ACK. Patches have been released for various stable kernel branches including 5.15.y, 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux 5.11 to 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36
Timeline
- 2026-06-16: other: Patch authored by Paolo Abeni
- 2026-07-19: disclosed: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/301a33fd590c408a05c5df800e0cc1e6a8a2f8f8
- https://git.kernel.org/stable/c/3b8cbba7c0ed31189c89f90be247b8973ffa79ef
- https://git.kernel.org/stable/c/68364963e5baf03f16b4420292291f75c8f66497
- https://git.kernel.org/stable/c/8ab24fdebc369c0dfb90f82c1650b1e66662bb45
- https://git.kernel.org/stable/c/8f4f0a157e8436a05bf8c3670b24dbc258911c43
- https://git.kernel.org/stable/c/907ac6b1658e0277f979fcdfae2a753b495c1510
- https://git.kernel.org/stable/c/c4f4cf60797974873dbc8e100144682a6f2f861f