CVE-2026-68170

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Multipath TCP (MPTCP) implementation. The problem occurs during the closure of a subflow when the cleanup of backlog references is performed in the mptcp close ssk() function without holding the mptcp data lock() or the ssk lock. This allows concurrent RX processing on another CPU via subflow data ready() -> mptcp data ready() -> mptcp add backlog() to add a backlog entry referencing the ssk while the cleanup is in progress. This can result in a stale skb->sk pointer pointing to the ssk after it has been freed. Subsequently, the mptcp backlog purge() function dereferences this stale pointer, leading to a use-after-free condition and triggering a warning in inet sock destruct() due to ssk->sk rmem alloc not being zero.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.