CVE-2026-31669
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A use-after-free vulnerability was found in the Linux kernel's MPTCP implementation, specifically in __inet_lookup_established. The issue arises from incorrect initialization of the TCPv6 protocol for MPTCP subflow child sockets, which are allocated via kmalloc instead of the proper slab cache with SLAB_TYPESAFE_BY_RCU flag. This allows concurrent access to freed memory during ehash table lookups, potentially leading to security breaches.
Risk Assessment
The organization faces potential data integrity violations or system crashes due to uncontrolled access to freed kernel memory. The vulnerability could be exploited locally for privilege escalation or system destabilization.
Recommendation
Immediately update the Linux kernel to a version containing the fix that splits MPTCP initialization for IPv6 and ensures proper inheritance of the SLAB_TYPESAFE_BY_RCU flag. Monitor security advisories from your Linux distribution.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side critical sections. Both tcp_prot and tcpv6_prot have their slab caches created with this flag via proto_register(). However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override during inet_init() (fs_initcall, level 5), before inet6_init() (module_init/device_initcall, level 6) has called proto_register(&tcpv6_prot). At that point, tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab remains NULL permanently. This causes MPTCP v6 subflow child sockets to be allocated via kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so when these sockets are freed without SOCK_RCU_FREE (which is cleared for child sockets by design), the memory can be immediately reused. Concurrent ehash lookups under rcu_read_lock can then access freed memory, triggering a slab-use-after-free in __inet_lookup_established. Fix this by splitting the IPv6-specific initialization out of mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called from mptcp_proto_v6_init() before protocol registration. This ensures tcpv6_prot_override.slab correctly inherits the SLAB_TYPESAFE_BY_RCU slab cache.