CVE-2026-43252: Linux Kernel Privilege Escalation Flaw

CVE-2026-43252 Overview

CVE-2026-43252 is a Linux kernel vulnerability in the Multipath TCP (MPTCP) in-kernel path manager. The flaw resides in net/mptcp/pm_kernel.c and was discovered through Syzkaller fuzzing. Specific sequences of netlink operations targeting MPTCP endpoint management trigger a WARN_ON at line 1074 of __mark_subflow_endp_available. The fix ensures that the endpoint identifier is always marked as available when an endpoint is removed, preventing the kernel warning state during fullmesh subflow handling.

Critical Impact
Local users can trigger kernel warnings through crafted netlink messages to the MPTCP path manager, leading to potential denial of service conditions on systems with MPTCP enabled.

Affected Products

Linux Kernel (mainline) prior to the fix in commit 7c1d221e475e3d8eb8ed4702392d43f8c5134d1f
Linux Kernel stable branches receiving backports via commits 1b3ff4d, 4d480ef, 7e4d88e, d191101, and d90d73a
Distributions shipping kernels with MPTCP support enabled (CONFIG_MPTCP)

Discovery Timeline

2026-05-06 - CVE-2026-43252 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43252

Vulnerability Analysis

The vulnerability exists in the in-kernel path manager component of MPTCP, the protocol extension that allows a single TCP connection to use multiple network paths simultaneously. Syzkaller identified a sequence of operations that reaches __mark_subflow_endp_available in net/mptcp/pm_kernel.c with state inconsistent with the function's expectations, triggering a WARN_ON assertion at line 1074.

The call path traverses mptcp_pm_nl_set_flags, mptcp_pm_nl_set_flags_all, and mptcp_pm_nl_fullmesh before reaching the warning. The warning fires during generic netlink message processing through the mptcp_pm_nl_set_flags_doit handler, invoked from userspace via sendmsg against the MPTCP path manager netlink family.

The issue surfaces when an endpoint is removed but its identifier is not consistently marked as available. Subsequent operations on the same endpoint identifier in fullmesh mode encounter unexpected state and trigger the kernel warning.

Root Cause

The root cause is missing state synchronization in the MPTCP endpoint removal path. When rm endp operations execute, the endpoint identifier was not unconditionally set to available. Subsequent flag-setting operations through mptcp_pm_nl_set_flags could then operate on an identifier whose availability tracking diverged from its actual lifecycle state.

Attack Vector

A local user with permissions to send MPTCP netlink commands can craft a sequence of endpoint add, remove, and flag-modification operations against the generic netlink interface. The fuzzer reproducer demonstrates that automated tooling can reach the warning condition without specialized privileges beyond standard netlink access.

The vulnerability is described in prose because no public proof-of-concept exploit is available beyond the Syzkaller report. See the Linux Kernel Commit 7c1d221 for the upstream fix.

Detection Methods for CVE-2026-43252

Indicators of Compromise

Kernel log entries containing WARNING: net/mptcp/pm_kernel.c:1074 referencing __mark_subflow_endp_available
Stack traces showing mptcp_pm_nl_set_flags, mptcp_pm_nl_fullmesh, or mptcp_pm_nl_set_flags_all in the call chain
Repeated MPTCP genetlink set_flags operations preceded by endpoint removal commands from non-administrative processes

Detection Strategies

Monitor dmesg and /var/log/kern.log for MPTCP path manager warnings using log forwarding to a central SIEM
Audit AUDIT_NETLINK events for the MPTCP generic netlink family to identify processes issuing path manager commands
Correlate kernel warning bursts with process execution telemetry to identify the originating workload

Monitoring Recommendations

Enable kernel.panic_on_warn=0 in production but ship warnings to centralized logging for review
Track MPTCP feature usage through /proc/net/mptcp_pm and ip mptcp endpoint show to scope exposure
Alert on unexpected use of the MPTCP netlink family by user-space binaries outside normal network management daemons

How to Mitigate CVE-2026-43252

Immediate Actions Required

Apply the upstream kernel patches referenced in the official commits and rebuild affected kernels
Track distribution security advisories from Red Hat, SUSE, Debian, Ubuntu, and other vendors for backported fixes
Restrict access to MPTCP netlink operations to trusted administrative processes via capabilities and seccomp policies

Patch Information

The fix is available in the following Linux kernel commits: Linux Kernel Commit 7c1d221, Linux Kernel Commit 1b3ff4d, Linux Kernel Commit 4d480ef, Linux Kernel Commit 7e4d88e, Linux Kernel Commit d191101, and Linux Kernel Commit d90d73a. The patch ensures the endpoint ID is always marked as available when removing an endpoint in the in-kernel path manager.

Workarounds

Disable MPTCP if not required by setting net.mptcp.enabled=0 via sysctl to remove the attack surface
Unload or blacklist MPTCP path manager functionality on systems that do not need multipath connectivity
Apply seccomp filters to restrict sendmsg calls targeting AF_NETLINK sockets for untrusted workloads

bash

# Configuration example
# Disable MPTCP system-wide if not required
sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled = 0' >> /etc/sysctl.d/99-disable-mptcp.conf

# Verify current MPTCP endpoints
ip mptcp endpoint show

# Audit MPTCP netlink usage
auditctl -a always,exit -F arch=b64 -S sendmsg -F a0!=0 -k mptcp_netlink