CVE-2026-63867: Linux Kernel MPTCP Race Condition Flaw

CVE-2026-63867 Overview

CVE-2026-63867 is a time-of-check time-of-use (TOCTOU) race condition in the Linux kernel's Multipath TCP (MPTCP) implementation. The MPTCP output path accesses the MPTCP-level ack_seq locklessly multiple times when constructing a single outgoing packet. This can result in the data_ack value in the DSS option and the announced receive window (rcv_wnd) being computed from inconsistent values. A remote peer may observe divergent state from the same packet, disrupting MPTCP session integrity and availability.

Critical Impact
Remote unauthenticated attackers on the network path can trigger inconsistent MPTCP state, leading to integrity issues and denial of service against Linux systems using MPTCP subflows.

Affected Products

Linux kernel — MPTCP subsystem (net/mptcp/)
Distributions shipping affected upstream kernel versions with MPTCP enabled
Any workload relying on MPTCP for connectivity across multiple paths

Discovery Timeline

2026-07-19 - CVE-2026-63867 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63867

Vulnerability Analysis

MPTCP extends TCP by allowing a single connection to use multiple subflows across different network paths. Each outgoing MPTCP packet carries a Data Sequence Signal (DSS) option that encodes the MPTCP-level acknowledgment (data_ack) and influences the announced receive window.

The vulnerability arises because the output path reads the MPTCP-level ack_seq without holding a lock and does so more than once while constructing the same packet. Between reads, another CPU can update ack_seq. The packet is then transmitted with a data_ack value that no longer matches the value used to compute rcv_wnd. Peers receiving this inconsistent DSS may become confused, mis-track sequence state, or terminate the session.

The upstream fix refactors the code to compute both values from a single consistent snapshot and updates the MPTCP-level rcv_wnd only when the egress packet actually carries a DSS ack.

Root Cause

The root cause is lockless, non-atomic access to shared MPTCP state during packet construction. The ack_seq field is read multiple times without synchronization, permitting concurrent writers to change the value between reads. This is a classic TOCTOU pattern in kernel networking code.

Attack Vector

Exploitation requires network reachability to a Linux system with active MPTCP subflows. An attacker on the network path, or a malicious peer, can drive traffic patterns that increase the frequency of concurrent ack_seq updates during packet emission. Successful triggering produces MPTCP packets with inconsistent DSS state, degrading integrity and availability of the connection.

No verified public exploit code is available. See the upstream commits referenced below for technical details on the fix.

Detection Methods for CVE-2026-63867

Indicators of Compromise

Unexpected MPTCP subflow resets (MP_FASTCLOSE, MP_TCPRST) on hosts running vulnerable kernels
MPTCP MIB counter increases for MPTcpExtDSSNotMatching or similar DSS validation failures
Application-layer disconnects on services using MPTCP, correlated with high concurrent traffic
Kernel version strings matching pre-patch releases on hosts using MPTCP

Detection Strategies

Inventory Linux hosts and enumerate kernel versions to identify systems missing the referenced commits (301a33f, 3b8cbba, 6836496, 8ab24fd, 8f4f0a1, 907ac6b, c4f4cf6)
Monitor /proc/net/netstat MPTCP counters for anomalous DSS or reset activity
Correlate MPTCP session terminations with network telemetry to identify potentially triggered races

Monitoring Recommendations

Ingest kernel logs, nstat MPTCP counters, and connection telemetry into a centralized analytics platform
Alert on spikes in MPTCP subflow failures or DSS validation errors on production hosts
Track patch state for the Linux kernel across the fleet and flag hosts running vulnerable versions

How to Mitigate CVE-2026-63867

Immediate Actions Required

Identify all Linux hosts with MPTCP enabled (sysctl net.mptcp.enabled) and prioritize patching
Apply the upstream kernel updates that include the MPTCP TOCTOU fix from your distribution vendor
Reboot systems after kernel updates to activate the patched code path

Patch Information

The fix is present in the following upstream kernel commits: Kernel Git Commit 301a33f, Kernel Git Commit 3b8cbba, Kernel Git Commit 6836496, Kernel Git Commit 8ab24fd, Kernel Git Commit 8f4f0a1, Kernel Git Commit 907ac6b, and Kernel Git Commit c4f4cf6. The refactor eliminates repeated lockless reads of ack_seq and gates rcv_wnd updates on the presence of a DSS ack in the egress packet.

Workarounds

Disable MPTCP on hosts that do not require it by setting net.mptcp.enabled=0 via sysctl
Restrict exposure of MPTCP-enabled services to trusted networks until patches are deployed
Fall back to plain TCP for critical services if immediate patching is not feasible

bash

# Check MPTCP status and disable if not required
sysctl net.mptcp.enabled
sudo sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

# Verify installed kernel version
uname -r