CVE-2024-26826

What it actually does

Incorrect TCP-specific helper used on MPTCP socket to check for unacked data in RTX queue; after TCP fast path reorganization the check always fails causing the packet scheduler to skip re-injection of mptcp-level unacked data on stale subflows.

Why it matters to the business

Multipath TCP connections on Linux may silently fail to recover data after subflow changes, leading to reduced throughput or stalled transfers in environments relying on MPTCP for resilience or aggregation.

How an attack unfolds

An attacker with the ability to influence subflow state (for example by network manipulation or local socket interaction) can trigger the stale-subflow path; because the early check always skips re-injection after the referenced TCP change, unacknowledged MPTCP data is never retransmitted on alternate subflows.

How to fix it

Upgrade the Linux kernel to a version containing commit 6f95120f898b40d13fd441225ef511307853c9c2 or later; apply the stable update that removes the bogus TCP helper call in the MPTCP stale-subflow handling path.

How to confirm the fix worked

Confirm the running kernel contains commit 6f95120f898b40d13fd441225ef511307853c9c2; verify MPTCP re-injection occurs on stale subflows by exercising the path-manager logic or reviewing the patched mptcp code.

Typical attack path

1. Establish or observe an MPTCP connection with multiple subflows
2. Cause or wait for a subflow to be marked stale by the path manager
3. Trigger the scheduler's stale-subflow recovery logic
4. Observe that the broken check prevents re-injection of unacked data

How to detect it

Review kernel logs and MPTCP debug output for stale-subflow events; correlate with TCP retransmission or MPTCP-level unacked queue behavior on systems running kernels before the referenced commit.

What your security team should do

• Apply the kernel update containing commit 6f95120f898b40d13fd441225ef511307853c9c2 to all affected systems
• Prioritize systems that actively use MPTCP for production traffic
• Monitor kernel changelogs for related MPTCP scheduler fixes