CVE-2026-31669: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31669 Overview

CVE-2026-31669 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Multipath TCP (MPTCP) subsystem. The flaw resides in the __inet_lookup_established code path and stems from incorrect initialization ordering between mptcp_subflow_init() and inet6_init(). MPTCP IPv6 subflow child sockets are allocated from kmalloc-4k instead of the dedicated TCPv6 slab cache, which lacks the SLAB_TYPESAFE_BY_RCU guarantee. Concurrent lockless ehash table lookups under RCU read-side critical sections can therefore access freed socket memory. The vulnerability affects Linux kernel versions including 5.12 and 7.0 release candidates rc1 through rc7.

Critical Impact
Remote attackers can trigger memory corruption in the kernel network stack without authentication or user interaction, potentially leading to denial of service or arbitrary code execution in kernel context.

Affected Products

Linux kernel (multiple versions, see CPE list)
Linux kernel 5.12
Linux kernel 7.0 release candidates rc1 through rc7

Discovery Timeline

2026-04-24 - CVE-2026-31669 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31669

Vulnerability Analysis

The vulnerability is a slab use-after-free in __inet_lookup_established triggered through MPTCP IPv6 subflow socket allocation. The Linux kernel's ehash table lookups operate without locks and rely on the SLAB_TYPESAFE_BY_RCU slab flag to keep socket memory stable during RCU read-side critical sections. Both tcp_prot and tcpv6_prot register their slab caches with this flag through proto_register().

MPTCP introduces an override structure, tcpv6_prot_override, that copies tcpv6_prot for subflow handling. Because the copy happens before tcpv6_prot.slab is initialized, the override permanently holds a NULL slab pointer. Subflow child sockets then bypass the dedicated TCPv6 slab and fall into a generic kmalloc-4k cache that does not provide type-safe RCU semantics.

Root Cause

The root cause is an initialization ordering bug. mptcp_subflow_init() runs during inet_init() at fs_initcall level 5, but inet6_init() executes at device_initcall level 6 and only then calls proto_register(&tcpv6_prot). At the moment MPTCP copies tcpv6_prot into tcpv6_prot_override, the source structure's slab field is still NULL, so the override permanently inherits a NULL slab pointer.

Attack Vector

A remote attacker who can establish or influence MPTCP v6 connections can cause subflow child sockets to be allocated from kmalloc-4k. Child sockets have SOCK_RCU_FREE cleared by design, so freed memory is reusable immediately. A concurrent ehash lookup under rcu_read_lock can then dereference a freed socket, producing a slab use-after-free condition in __inet_lookup_established. The fix splits IPv6-specific initialization into a new mptcp_subflow_v6_init() function called from mptcp_proto_v6_init() after proto_register() completes, ensuring tcpv6_prot_override.slab correctly inherits the SLAB_TYPESAFE_BY_RCU cache.

No public proof-of-concept code is available for this vulnerability. Refer to the upstream kernel commits in the Kernel Git repository for the authoritative patch and technical analysis.

Detection Methods for CVE-2026-31669

Indicators of Compromise

Kernel oops or panic messages referencing __inet_lookup_established or slab use-after-free conditions in syslog or dmesg.
KASAN reports indicating use-after-free in TCP/MPTCP socket structures allocated from kmalloc-4k.
Unexpected kernel crashes on systems with MPTCP enabled (/proc/sys/net/mptcp/enabled set to 1) during IPv6 traffic.

Detection Strategies

Audit running kernel versions against the patched commits listed in vendor advisories using uname -r and distribution package metadata.
Enable Kernel Address Sanitizer (KASAN) in test or staging environments to surface use-after-free conditions in the MPTCP code path.
Monitor for anomalous MPTCP IPv6 connection patterns, including high-volume subflow establishment from untrusted networks.

Monitoring Recommendations

Forward kernel logs to a centralized telemetry platform and alert on BUG:, KASAN:, or slab-use-after-free strings.
Track network telemetry for MPTCP option usage in TCP SYN packets and correlate with kernel stability events.
Inventory Linux endpoints and servers with MPTCP support compiled in (CONFIG_MPTCP=y) to scope exposure.

How to Mitigate CVE-2026-31669

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisories as soon as distribution-rebuilt kernels are available.
Identify hosts where MPTCP is enabled and prioritize them for patching, especially internet-facing systems.
If patching is not immediately possible, disable MPTCP via sysctl -w net.mptcp.enabled=0 to remove the vulnerable code path.

Patch Information

The Linux kernel maintainers have published fixes across multiple stable branches. The corrective commits include 15fa9ead4d5e, 3fd6547f5b8a, 9b55b253907e, b313e9037d98, eb9c6aeb512f, f6e1f25fa5e7, and fb1f54b7d16f. See the Kernel Git Commit entries linked in the NVD record. Apply the kernel update provided by your Linux distribution and reboot affected hosts.

Workarounds

Disable MPTCP at runtime with sysctl -w net.mptcp.enabled=0 and persist the setting in /etc/sysctl.d/.
Restrict inbound IPv6 traffic to MPTCP-capable services using host or network firewalls until patches are deployed.
Rebuild custom kernels with CONFIG_MPTCP disabled where MPTCP is not required by workloads.

bash

# Configuration example
# Disable MPTCP system-wide as a temporary workaround
sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled=0' > /etc/sysctl.d/99-disable-mptcp.conf

# Verify MPTCP is disabled
cat /proc/sys/net/mptcp/enabled