Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-63867

mptcp: close TOCTOU race while computing rcv_wnd

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • fa3fe2b150316b294f2c662653501273ff25bba8 to < 301a33fd590c408a05c5df800e0cc1e6a8a2f8f8affected
  • fa3fe2b150316b294f2c662653501273ff25bba8 to < 68364963e5baf03f16b4420292291f75c8f66497affected
  • fa3fe2b150316b294f2c662653501273ff25bba8 to < 907ac6b1658e0277f979fcdfae2a753b495c1510affected
  • fa3fe2b150316b294f2c662653501273ff25bba8 to < c4f4cf60797974873dbc8e100144682a6f2f861faffected
  • fa3fe2b150316b294f2c662653501273ff25bba8 to < 3b8cbba7c0ed31189c89f90be247b8973ffa79efaffected
  • fa3fe2b150316b294f2c662653501273ff25bba8 to < 8f4f0a157e8436a05bf8c3670b24dbc258911c43affected
  • fa3fe2b150316b294f2c662653501273ff25bba8 to < 8ab24fdebc369c0dfb90f82c1650b1e66662bb45affected

Linux Linux

Default version status: affected

  • 5.11affected
  • 0 to < 5.11unaffected
  • 5.15.210 to ≤ 5.15.*unaffected
  • 6.1.176 to ≤ 6.1.*unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.94 to ≤ 6.12.*unaffected
  • 6.18.36 to ≤ 6.18.*unaffected
  • 7.0.13 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References