{"id":"CVE-2026-31669","revision":"07f5d0a2ff0e48ba94463782fbcbeef7","records":[{"revision":"07f5d0a2ff0e48ba94463782fbcbeef7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31669","aliases":[],"title":"mptcp: fix slab-use-after-free in __inet_lookup_established","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix slab-use-after-free in __inet_lookup_established\n\nThe ehash table lookups are lockless and rely on\nSLAB_TYPESAFE_BY_RCU to guarantee socket memory stability\nduring RCU read-side critical sections. Both tcp_prot and\ntcpv6_prot have their slab caches created with this flag\nvia proto_register().\n\nHowever, MPTCP's mptcp_subflow_init() copies tcpv6_prot into\ntcpv6_prot_override during inet_init() (fs_initcall, level 5),\nbefore inet6_init() (module_init/device_initcall, level 6) has\ncalled proto_register(&tcpv6_prot). At that point,\ntcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab\nremains NULL permanently.\n\nThis causes MPTCP v6 subflow child sockets to be allocated via\nkmalloc (falling into kmalloc-4k) instead of the TCPv6 slab\ncache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so\nwhen these sockets are freed without SOCK_RCU_FREE (which is\ncleared for child sockets by design), the memory can be\nimmediately reused. Concurrent ehash lookups under\nrcu_read_lock can then access freed memory, triggering a\nslab-use-after-free in __inet_lookup_established.\n\nFix this by splitting the IPv6-specific initialization out of\nmptcp_subflow_init() into a new mptcp_subflow_v6_init(), called\nfrom mptcp_proto_v6_init() before protocol registration. This\nensures tcpv6_prot_override.slab correctly inherits the\nSLAB_TYPESAFE_BY_RCU slab cache.","state":0,"publishedAt":"2026-04-24T14:45:17.295+00:00","modifiedAt":"2026-10-19T18:56:03.36+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mptcp/protocol.c\",\n                        \"net/mptcp/protocol.h\",\n                        \"net/mptcp/subflow.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b19bc2945b40b9fd38e835700907ffe8534ef0de\",\n                            \"lessThan\": \"f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b19bc2945b40b9fd38e835700907ffe8534ef0de\",\n                            \"lessThan\": \"fb1f54b7d16f393b8b65d328410f78b4beea8fcc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b19bc2945b40b9fd38e835700907ffe8534ef0de\",\n                            \"lessThan\": \"3fd6547f5b8ac99687be6d937a0321efda760597\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b19bc2945b40b9fd38e835700907ffe8534ef0de\",\n                            \"lessThan\": \"eb9c6aeb512f877cf397deb1e4526f646c70e4a7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b19bc2945b40b9fd38e835700907ffe8534ef0de\",\n                            \"lessThan\": \"15fa9ead4d5e6b6b9c794e84144146c917f2cb62\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b19bc2945b40b9fd38e835700907ffe8534ef0de\",\n                            \"lessThan\": \"b313e9037d98c13938740e5ebda7852929366dff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b19bc2945b40b9fd38e835700907ffe8534ef0de\",\n                            \"lessThan\": \"9b55b253907e7431210483519c5ad711a37dafa1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mptcp/protocol.c\",\n                        \"net/mptcp/protocol.h\",\n                        \"net/mptcp/subflow.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.203\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.169\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.135\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.82\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.23\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.13\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47","https://git.kernel.org/stable/c/fb1f54b7d16f393b8b65d328410f78b4beea8fcc","https://git.kernel.org/stable/c/3fd6547f5b8ac99687be6d937a0321efda760597","https://git.kernel.org/stable/c/eb9c6aeb512f877cf397deb1e4526f646c70e4a7","https://git.kernel.org/stable/c/15fa9ead4d5e6b6b9c794e84144146c917f2cb62","https://git.kernel.org/stable/c/b313e9037d98c13938740e5ebda7852929366dff","https://git.kernel.org/stable/c/9b55b253907e7431210483519c5ad711a37dafa1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31669","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31669","identifiers":["CVE-2026-31669"]},"retained":false,"historicalAffected":[]}],"coverage":[]}