CVE-2026-45889: Linux Kernel MPTCP Race Condition Flaw

CVE-2026-45889 Overview

CVE-2026-45889 is a Linux kernel vulnerability in the Multipath TCP (MPTCP) subsystem. The flaw resides in mptcp_rcvbuf_grow(), which incorrectly accounted for MPTCP-level out-of-order (OoO) packets when sizing the receive buffer. Because MPTCP-level OoOs are expected when multiple subflows are active, this accounting caused the receive buffer to drift toward tcp_rmem[2] and exposed a race condition during rcvspace initialization. Under specific timing, the first OoO data reaching the rcvbuf could trigger a divide-by-zero kernel oops. The issue has been resolved in upstream stable kernel commits.

Critical Impact
A divide-by-zero in the MPTCP receive path can crash the kernel, producing a local denial-of-service condition on hosts using MPTCP sockets.

Affected Products

Linux kernel versions containing the pre-patch mptcp_rcvbuf_grow() implementation
Distributions shipping MPTCP-enabled kernels prior to the referenced stable commits
Workloads using MPTCP sockets with multiple concurrent subflows

Discovery Timeline

2026-05-27 - CVE-2026-45889 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45889

Vulnerability Analysis

The vulnerability lives in the MPTCP receive buffer auto-tuning path. mptcp_rcvbuf_grow() increased the receive buffer based on observed out-of-order packet accounting. In MPTCP, however, OoO arrivals at the MPTCP layer are a normal consequence of multiple subflows delivering segments at different rates. They are not symptomatic of loss or reordering on a single TCP path.

Treating those OoOs as a signal to grow the receive buffer caused the rcvbuf to drift upward toward the system limit tcp_rmem[2]. The same code path also intersected with rcvspace initialization. When a user-space thread held the msk-level socket lock, the receive callback could complete rcvspace initialization after OoO data had already reached the rcvbuf. The resulting state mismatch made a divisor zero on the next computation, triggering a kernel oops.

Root Cause

The root cause is incorrect telemetry interpretation in mptcp_rcvbuf_grow(). MPTCP-level OoO events were conflated with TCP-level OoO events, which carry different semantics. The fix removes MPTCP-level OoO accounting from the receive buffer growth heuristic. Subflows continue to account for TCP-level OoO when the MPTCP-level rcvbuf is propagated.

Attack Vector

The condition is reached through normal MPTCP traffic patterns where multiple subflows deliver data concurrently. A local or networked peer interacting with an MPTCP socket can produce the timing required to race rcvspace initialization against OoO arrival. Successful triggering causes a divide-by-zero oops in the kernel rather than memory corruption or privilege escalation.

The vulnerability is described in prose only; refer to the upstream commits for the exact code change. See the Kernel Git commit 400ee485, commit 6b329393, and commit fb7bf00b.

Detection Methods for CVE-2026-45889

Indicators of Compromise

Kernel oops messages referencing mptcp_rcvbuf_grow or a divide-error in the MPTCP receive path
Unexpected SIGKILL or socket teardown events on processes using MPTCP sockets
Kernel ring buffer (dmesg) entries showing divide-by-zero exceptions following MPTCP subflow activity

Detection Strategies

Inventory kernels exposing MPTCP (CONFIG_MPTCP=y) and compare against the patched stable releases referenced in the upstream commits
Audit hosts that establish MPTCP sockets, including load balancers, mobile gateways, and multi-homed servers
Correlate kernel crash telemetry with MPTCP socket usage to identify likely triggers

Monitoring Recommendations

Forward kernel.log and dmesg output to a centralized logging pipeline and alert on divide-error or oops entries
Track host availability and unexpected reboots on MPTCP-enabled systems
Monitor /proc/sys/net/mptcp/enabled state and inventory which workloads negotiate MPTCP

How to Mitigate CVE-2026-45889

Immediate Actions Required

Apply the upstream stable kernel patches that remove MPTCP-level OoO accounting from mptcp_rcvbuf_grow()
Rebuild or update distribution kernels that backport the referenced commits and reboot affected hosts
Where patching is delayed, restrict MPTCP usage to trusted workloads and peers

Patch Information

The fix is committed upstream in the Linux stable tree. Reference the patches at commit 400ee485, commit 6b329393, and commit fb7bf00b. Distribution maintainers are expected to ship these in stable kernel updates.

Workarounds

Disable MPTCP system-wide by setting net.mptcp.enabled=0 via sysctl until the kernel is patched
Prevent applications from negotiating MPTCP by removing the IPPROTO_MPTCP socket option from application configurations
Limit exposure of MPTCP-enabled services to untrusted networks using firewall policy

bash

# Configuration example
# Temporarily disable MPTCP until a patched kernel is deployed
sudo sysctl -w net.mptcp.enabled=0

# Persist the setting across reboots
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

# Verify the current state
sysctl net.mptcp.enabled