Cloudanix VulnDB

CVE-2026-68169

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing mistake in how Linux handles certain network connections can let a local attacker crash the system or possibly gain elevated access.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free in mptcp_pm_userspace_get_local_id allows a concurrent subflow deletion to free an address entry after it is looked up under spinlock but before its id field is read, resulting in a slab read of freed memory.

Why it matters to the business

Kernel memory corruption on systems using MPTCP with the userspace path manager can cause crashes, instability, or potential local privilege escalation, increasing downtime and patching urgency for high-availability or multi-homed deployments.

How an attack unfolds

An attacker triggers the narrow race by overlapping an MP_JOIN SYN with an MPTCP_PM_CMD_SUBFLOW_DESTROY request while the userspace path manager is active, causing the freed address structure to be accessed after kfree in mptcp_userspace_pm_delete_local_addr.

How to fix it

Apply the upstream fix that copies the address id into a local variable while the spinlock is still held; upgrade to a kernel containing the resolution for CVE-2026-68169.

How to confirm the fix worked

Confirm the patch is present by inspecting mptcp_pm_userspace_get_local_id for the id copy under lock and re-running the original KASAN stress test to verify absence of slab-use-after-free reports.

Typical attack path

  1. Enable MPTCP with userspace path manager on target
  2. Establish initial subflow and announce additional addresses
  3. Issue concurrent MP_JOIN SYN while sending subflow destroy command
  4. Trigger UAF read of id field from freed slab entry
  5. Escalate via kernel memory corruption or induce denial of service

How to detect it

Search kernel logs for KASAN slab-use-after-free reports mentioning mptcp_userspace_pm_get_local_id or mptcp_pm_get_local_id; inspect audit logs for rapid sequences of MPTCP_PM_CMD_SUBFLOW_DESTROY commands coinciding with new subflow creation.

  • mptcp_userspace_pm_get_local_id+0x1dc/0x1f0
  • BUG: KASAN: slab-use-after-free in mptcp

What your security team should do

  • Prioritize patching kernels that enable MPTCP userspace path manager on multi-homed systems
  • Disable userspace PM or MPTCP if the workload does not require it until fixed kernels are deployed
  • Monitor for future MPTCP-related use-after-free reports given the component's history

The record

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in get_local_id In mptcp_pm_userspace_get_local_id(), the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the unlock and the read, leading to UAF. The race window is narrow. It was reproduced only with a locally constructed stress test that repeatedly overlaps an MP_JOIN SYN with a MPTCP_PM_CMD_SUBFLOW_DESTROY request. However, the KASAN report below confirms that the race is reachable: [ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0 ... [ 666.319401] Call Trace: [ 666.319405] <IRQ> [ 666.319408] dump_stack_lvl+0x53/0x70 [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0 [ 666.319418] print_report+0xbe/0x2b0 [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319423] kasan_report+0xce/0x100 [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319433] mptcp_pm_get_local_id+0x371/0x440 ... [ 666.319821] Allocated by task 45539: [ 666.319844] kasan_save_stack+0x33/0x60 [ 666.319855] kasan_save_track+0x14/0x30 [ 666.319858] __kasan_kmalloc+0x8f/0xa0 [ 666.319863] __kmalloc_noprof+0x1e7/0x520 [ 666.319867] sock_kmalloc+0xdf/0x130 [ 666.319885] sock_kmemdup+0x1b/0x40 [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500 [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610 ... [ 666.319967] Freed by task 45560: [ 666.319988] kasan_save_stack+0x33/0x60 [ 666.319991] kasan_save_track+0x14/0x30 [ 666.319994] kasan_save_free_info+0x3b/0x60 [ 666.319998] __kasan_slab_free+0x43/0x70 [ 666.320000] kfree+0x166/0x440 [ 666.320003] sock_kfree_s+0x1d/0x50 [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200 [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0 Fix by copying the id into a local variable while still holding the lock, and use -1 as a "not found" sentinel.

Affected packages

Ecosystem Package Introduced Fixed