CVE-2026-31669

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix slab-use-after-free in __inet_lookup_established

The ehash table lookups are lockless and rely on

SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability

during RCU read-side critical sections. Both tcp_prot and

tcpv6_prot have their slab caches created with this flag

via proto_register().

However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into

tcpv6_prot_override during inet_init() (fs_initcall, level 5),

before inet6_init() (module_init/device_initcall, level 6) has

called proto_register(&tcpv6_prot). At that point,

tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab

remains NULL permanently.

This causes MPTCP v6 subflow child sockets to be allocated via

kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab

cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so

when these sockets are freed without SOCK_RCU_FREE (which is

cleared for child sockets by design), the memory can be

im

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References