What’s Vulnerable › Vulnerabilities

CVE-2026-63867: mptcp: close TOCTOU race while computing rcv_wnd

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-19 · updated 2026-10-26
• Weakness: CWE-367

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.

Affected products

• Linux kernel: from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13 — fixed in 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13
• Linux kernel: 5.11 — fixed in 7.1

How to fix

Upgrade to a fixed version: Linux kernel 5.15.210, 6.1.176, 6.6.143, 6.12.94; Linux kernel 7.1. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/301a33fd590c408a05c5df800e0cc1e6a8a2f8f8
• https://git.kernel.org/stable/c/3b8cbba7c0ed31189c89f90be247b8973ffa79ef
• https://git.kernel.org/stable/c/68364963e5baf03f16b4420292291f75c8f66497
• https://git.kernel.org/stable/c/8ab24fdebc369c0dfb90f82c1650b1e66662bb45
• https://git.kernel.org/stable/c/8f4f0a157e8436a05bf8c3670b24dbc258911c43
• https://git.kernel.org/stable/c/907ac6b1658e0277f979fcdfae2a753b495c1510
• https://git.kernel.org/stable/c/c4f4cf60797974873dbc8e100144682a6f2f861f

Get alerted when CVE-2026-63867 or the next vulnerability affects your stack