CVE-2026-63867

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A TOCTOU (Time-of-Check to Time-of-Use) race condition exists in the MPTCP output path. The system accesses the MPTCP-level ack seq locklessly multiple times, which can lead to the use of different data ack values within the DSS option and the computation of the announced rcv wnd for the same packet. This inconsistency may confuse the peer. A TOCTOU race is a software bug where a system checks the state of a resource before using it, but the state changes between the check and the use.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.