From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-63867: mptcp: close TOCTOU race while computing rcv_wnd
Date: Sun, 19 Jul 2026 16:17:12 +0200 [thread overview]
Message-ID: <2026071912-CVE-2026-63867-eac1@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
mptcp: close TOCTOU race while computing rcv_wnd
The MPTCP output path access locklessly the MPTCP-level ack_seq
in multiple times, using possibly different values for the data_ack
in the DSS option and to compute the announced rcv wnd for the same
packet.
Refactor the cote to avoid inconsistencies which may confuse the
peer. Also ensure that the MPTCP level rcv wnd is updated only when
the egress packet actually contains a DSS ack.
The Linux kernel CVE team has assigned CVE-2026-63867 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.11 with commit fa3fe2b150316b294f2c662653501273ff25bba8 and fixed in 5.15.210 with commit 301a33fd590c408a05c5df800e0cc1e6a8a2f8f8
Issue introduced in 5.11 with commit fa3fe2b150316b294f2c662653501273ff25bba8 and fixed in 6.1.176 with commit 68364963e5baf03f16b4420292291f75c8f66497
Issue introduced in 5.11 with commit fa3fe2b150316b294f2c662653501273ff25bba8 and fixed in 6.6.143 with commit 907ac6b1658e0277f979fcdfae2a753b495c1510
Issue introduced in 5.11 with commit fa3fe2b150316b294f2c662653501273ff25bba8 and fixed in 6.12.94 with commit c4f4cf60797974873dbc8e100144682a6f2f861f
Issue introduced in 5.11 with commit fa3fe2b150316b294f2c662653501273ff25bba8 and fixed in 6.18.36 with commit 3b8cbba7c0ed31189c89f90be247b8973ffa79ef
Issue introduced in 5.11 with commit fa3fe2b150316b294f2c662653501273ff25bba8 and fixed in 7.0.13 with commit 8f4f0a157e8436a05bf8c3670b24dbc258911c43
Issue introduced in 5.11 with commit fa3fe2b150316b294f2c662653501273ff25bba8 and fixed in 7.1 with commit 8ab24fdebc369c0dfb90f82c1650b1e66662bb45
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-63867
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
net/mptcp/options.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/301a33fd590c408a05c5df800e0cc1e6a8a2f8f8
https://git.kernel.org/stable/c/68364963e5baf03f16b4420292291f75c8f66497
https://git.kernel.org/stable/c/907ac6b1658e0277f979fcdfae2a753b495c1510
https://git.kernel.org/stable/c/c4f4cf60797974873dbc8e100144682a6f2f861f
https://git.kernel.org/stable/c/3b8cbba7c0ed31189c89f90be247b8973ffa79ef
https://git.kernel.org/stable/c/8f4f0a157e8436a05bf8c3670b24dbc258911c43
https://git.kernel.org/stable/c/8ab24fdebc369c0dfb90f82c1650b1e66662bb45
reply other threads:[~2026-07-19 14:18 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026071912-CVE-2026-63867-eac1@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.