CVE-2026-45889

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Multipath TCP (MPTCP) implementation where accounting for Out-of-Order (OoO) packets in the mptcp rcvbuf grow() function causes the receive buffer to drift toward tcp rmem[2]. This occurs because MPTCP-level OoOs are normal when multiple subflows are active and do not result from packet drops or cause retransmissions. Additionally, a race condition exists during rcvspace initialization; if user-space holds the msk-level socket lock, initialization could complete in the receive callback, allowing the first OoO data to reach the receive buffer and potentially trigger a divide-by-zero Oops (a kernel panic caused by a fatal error).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.