Executive brief
The Linux kernel's MPTCP (Multipath TCP) protocol implementation contains a memory leak vulnerability in its path management subsystem. When a socket is torn down while concurrent userspace path management operations are in flight, allocations can be lost without being freed, potentially causing memory exhaustion over sustained load.
Technical details
The vulnerability is a race condition in mptcp_pm_destroy() where the function empties two lists (msk->pm.anno_list and msk->pm.userspace_pm_local_addr_list) under msk->pm.lock but drops the lock between list operations. A concurrent userspace PM ANNOUNCE handler can acquire the lock and add entries to these lists during the window between the first list being emptied and the second, and subsequently when destroy runs on the same socket via mptcp_disconnect(). The interleaved lock acquisitions cause new allocations to be added to list heads that are no longer being iterated, resulting in memory leaks of mptcp_pm_add_addr and mptcp_pm_addr_entry objects. The fix adds an MPTCP_PM_DESTROYING status bit that is set before list teardown and checked by allocation paths to refuse new entries. No patch state is reported; this appears to be a resolution notification.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-04: disclosed