CVE-2026-68169 Overview
CVE-2026-68169 is a use-after-free vulnerability in the Linux kernel's Multipath TCP (MPTCP) userspace path manager. The flaw resides in mptcp_pm_userspace_get_local_id(), where the kernel looks up an address entry under a spinlock but reads the entry's id field after releasing the lock. A concurrent deletion can free the entry between the unlock and the read, producing a slab use-after-free condition confirmed by KASAN.
The race is narrow but reachable when an MP_JOIN SYN overlaps with a MPTCP_PM_CMD_SUBFLOW_DESTROY netlink request. Exploitation targets the MPTCP subsystem on hosts running userspace path management.
Critical Impact
A local attacker with the ability to issue MPTCP netlink commands can trigger a kernel slab use-after-free, enabling denial of service or potential local privilege escalation.
Affected Products
- Linux kernel builds containing the MPTCP userspace path manager (mptcp_pm_userspace_get_local_id)
- Stable branches referenced by fix commits 31ce5af, 40dde4b, 9bc6d5e, d2c3760, and d64f6c0
- Distributions shipping vulnerable MPTCP-enabled kernels prior to backport
Discovery Timeline
- 2026-08-10 - CVE-2026-68169 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68169
Vulnerability Analysis
Multipath TCP allows a single TCP connection to use multiple network paths through subflows. The userspace path manager exposes netlink commands that let privileged applications announce local addresses and destroy subflows. Each announced address is tracked as an entry allocated with sock_kmalloc inside mptcp_userspace_pm_append_new_local_addr().
When a remote peer sends an MP_JOIN SYN, the kernel calls mptcp_pm_get_local_id(), which dispatches to mptcp_pm_userspace_get_local_id(). That function acquires a spinlock, locates the matching address entry, and drops the lock before dereferencing entry->addr.id. A concurrent MPTCP_PM_CMD_SUBFLOW_DESTROY handled by mptcp_userspace_pm_delete_local_addr() frees the entry via sock_kfree_s(), leaving the read path operating on freed slab memory.
Root Cause
The root cause is an atomicity violation [CWE-416]. The lookup and the field read must occur atomically under the same lock, but the original code releases the spinlock before consuming the pointer. The fix copies id into a local variable while the lock is held and uses -1 as a sentinel for the not-found case.
Attack Vector
Exploitation requires local access with sufficient privilege to issue MPTCP path manager netlink commands and the ability to induce an inbound MP_JOIN SYN. An attacker races repeated subflow destroy requests against subflow join attempts to hit the narrow window between spinlock release and pointer dereference. Successful races produce reads from freed slab memory, which can be shaped into information disclosure, kernel panic, or memory corruption depending on slab reuse.
No public proof-of-concept beyond the reporter's KASAN stress test is available. See the kernel patch commit d64f6c0 for the corrected locking pattern.
Detection Methods for CVE-2026-68169
Indicators of Compromise
- Kernel BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id messages in dmesg or /var/log/kern.log
- Unexpected kernel oops or panic stack traces referencing mptcp_pm_get_local_id or mptcp_userspace_pm_delete_local_addr
- Bursts of MPTCP_PM_CMD_SUBFLOW_DESTROY netlink commands correlated with inbound MP_JOIN SYN packets
Detection Strategies
- Enable CONFIG_KASAN on test kernels to surface the use-after-free during fuzzing or regression runs
- Audit AUDIT_NETLINK events for processes issuing MPTCP_PM_CMD_* commands and correlate with process lineage
- Monitor kernel ring buffer for MPTCP-related fault signatures using centralized log collection
Monitoring Recommendations
- Forward kern.log and audit netlink records to a SIEM for correlation with process and network telemetry
- Alert on repeated MPTCP subflow destroy commands from non-service accounts within short time windows
- Track kernel version and MPTCP configuration across the fleet to identify unpatched hosts running userspace path management
How to Mitigate CVE-2026-68169
Immediate Actions Required
- Apply the upstream fix from kernel commit d64f6c02495f3fad674038cfa7ec049671b59e7b or the stable backports 31ce5af, 40dde4b, 9bc6d5e, and d2c3760
- Restrict CAP_NET_ADMIN to trusted service accounts to limit who can issue MPTCP path manager netlink commands
- Rebuild or upgrade kernels from your distribution once the patched package is available
Patch Information
The fix copies the id value into a local variable while holding the spinlock and returns -1 as a not-found sentinel, eliminating the post-unlock dereference. Patched commits include 31ce5af, 40dde4b, 9bc6d5e, d2c3760, and d64f6c0.
Workarounds
- Disable the MPTCP userspace path manager where not required by setting net.mptcp.pm_type to the in-kernel path manager
- Set net.mptcp.enabled=0 via sysctl on systems that do not require MPTCP at all
- Block untrusted access to MPTCP netlink families using seccomp filters or Linux Security Module policies
# Configuration example
sysctl -w net.mptcp.enabled=0
# Or, if MPTCP is required, prefer the in-kernel path manager
sysctl -w net.mptcp.pm_type=0
# Persist across reboots
echo 'net.mptcp.enabled=0' >> /etc/sysctl.d/99-mptcp.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
