CVE-2026-31669
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A use-after-free vulnerability was found in the Linux kernel's MPTCP implementation, specifically in __inet_lookup_established. The issue arises from incorrect initialization of the TCPv6 protocol for MPTCP subflow child sockets, which are allocated via kmalloc instead of the proper slab cache with SLAB_TYPESAFE_BY_RCU flag. This allows concurrent access to freed memory during ehash table lookups, potentially leading to security breaches.
Risk Assessment
The organization faces potential data integrity violations or system crashes due to uncontrolled access to freed kernel memory. The vulnerability could be exploited locally for privilege escalation or system destabilization.
Recommendation
Immediately update the Linux kernel to a version containing the fix that splits MPTCP initialization for IPv6 and ensures proper inheritance of the SLAB_TYPESAFE_BY_RCU flag. Monitor security advisories from your Linux distribution.
Other vulnerabilities in Linux kernel
See all- CVE-2026-90049Unknown
In the Linux kernel, a vulnerability in skb_zerocopy() was fixed: it incorrectly called skb_tx_error() on the source skb when copying frags. This completed the zerocopy uarg and cleared the SKBFL_SHARED_FRAG flag on an skb still in use by the network stack. Specifically on the OVS_ACTION_ATTR_USERSPACE path, the skb was not freed on error, which could lead to ESP data being decrypted in place where the skb did not privately own frags, potentially causing data corruption or other issues.
- CVE-2026-90046Unknown
In the Linux kernel, free_pages_nolock() uses spin_trylock() in NMI context on uniprocessor (UP) systems, which is unsafe. The bug affects the page freeing path and can crash the kernel. It is likely exploitable by local attackers for privilege escalation.
- CVE-2026-90045Unknown
In the Linux kernel USB gadget ffs driver, the io_data structure stores a pointer to the submitting task's mm_struct but does not hold a reference while async requests are pending. This can cause a use-after-free if the task exits before completion handling finishes. The fix takes a reference with mmgrab() when queuing and releases it with mmdrop() on completion.
- CVE-2026-90044Unknown
In the Linux kernel USB gadget f_fs driver, a use-after-free exists in the AIO error path. When ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed, but the kiocb cancel function remains armed and points to the freed pointer. A concurrent cancel (e.g., sys_io_cancel()) can cause a use-after-free. The fix safely disarms the cancellation via kiocb->ki_complete() and returns -EIOCBQUEUED.
- CVE-2026-90043Unknown
In the Linux kernel zram module, the slot lock bit is set in the wrong position on 64-bit big-endian systems. Instead of landing in the flags field, it lands in ac_time, so with ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time wipes out the held lock bit and lets another CPU take the same slot lock. An access time value with that bit set can make the slot appear locked forever. The fix shifts the lock bit into the flags half on big-endian 64-bit.
- CVE-2026-90042Unknown
A vulnerability was found in the Linux kernel's Ceph filesystem where ceph_fname_to_usr() passed vmalloc() buffers to the fscrypt crypto API, which requires linear memory. This can cause kernel oopses, especially on non-x86 platforms. The fix adds support for vmalloc() buffers using a bounce buffer.
- CVE-2026-90041Unknown
In the Linux kernel, the HID sony driver fails to remove a controller from the device list when HID core input device registration fails. The devres-managed sony_sc is freed while its list node remains linked, leading to use-after-free when the next matching controller is handled.
- CVE-2026-90039Unknown
In the Linux kernel, NFSD admin state-revocation handlers (unlock_filesystem, NFSD_CMD_UNLOCK_FILESYSTEM, NFSD_CMD_UNLOCK_EXPORT) only check nn->nfsd_serv, which is set before nn->conf_id_hashtbl is allocated. This leads to a NULL dereference when the server has not yet started.
- CVE-2026-90038Unknown
In the Linux kernel, nfsd4_revoke_export_states() drops nn->client_lock but the held stateid reference does not pin the client. A concurrent client teardown can free the client while revoke_one_stid() still dereferences it, causing a use-after-free.
- CVE-2026-90037Unknown
In the Linux kernel, an nfs4_openowner left on nn->close_lru holds only a raw pointer to its nfs4_client. When the laundromat reaps entries, drops client_lock and calls nfs4_put_stid(), a concurrent force_expire_client() can free the client, causing a use-after-free.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side critical sections. Both tcp_prot and tcpv6_prot have their slab caches created with this flag via proto_register(). However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override during inet_init() (fs_initcall, level 5), before inet6_init() (module_init/device_initcall, level 6) has called proto_register(&tcpv6_prot). At that point, tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab remains NULL permanently. This causes MPTCP v6 subflow child sockets to be allocated via kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so when these sockets are freed without SOCK_RCU_FREE (which is cleared for child sockets by design), the memory can be immediately reused. Concurrent ehash lookups under rcu_read_lock can then access freed memory, triggering a slab-use-after-free in __inet_lookup_established. Fix this by splitting the IPv6-specific initialization out of mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called from mptcp_proto_v6_init() before protocol registration. This ensures tcpv6_prot_override.slab correctly inherits the SLAB_TYPESAFE_BY_RCU slab cache.