Executive brief
The Linux kernel's Multipath TCP (MPTCP) implementation does not properly reclaim memory allocated during receive path operations when packets are dropped due to errors. An attacker can trigger pathological packet drop scenarios to exhaust system memory, causing denial of service conditions on systems using MPTCP connections.
Technical details
This vulnerability is a memory leak in the MPTCP receive path (net/mptcp/protocol.c) introduced after commit 9db5b3cec4ec. When the mptcp_borrow_fwdmem() function allocates forward memory for incoming packets, errors occurring before the packets are queued into the receive buffer fail to trigger memory reclamation. An attacker can send specially crafted MPTCP packets that are dropped during receive processing, causing forward-allocated memory to accumulate without being freed. The fix adds explicit memory reclamation via sk_mem_reclaim() in the mptcp_drop() function when packets lack a destructor. Network-based attack; no authentication required; impacts availability via unbounded memory consumption leading to kernel out-of-memory conditions.
Affected products
- Linux Linux kernel 5.8 and later
Timeline
- 2026-08-26: disclosed
- 2026-08-06: patched: Patch commit 41b49a8b914ec7dcb03eae93fb27f3c464078644 merged upstream
- 2026-08-23: other: Patch backported to stable kernels