CVE-2026-68169

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: userspace: fix use-after-free in get_local_id

In mptcp_pm_userspace_get_local_id(), the address entry is looked up under

spinlock, but its id is read after dropping the lock. A concurrent deletion

can free the entry between the unlock and the read, leading to UAF.

The race window is narrow. It was reproduced only with a locally

constructed stress test that repeatedly overlaps an MP_JOIN SYN with a

MPTCP_PM_CMD_SUBFLOW_DESTROY request.

However, the KASAN report below confirms that the race is reachable:

[ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0

[ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0

...

[ 666.319401] Call Trace:

[ 666.319405] <IRQ>

[ 666.319408] dump_stack_lvl+0x53/0x70

[ 666.319412] print_address_description.constprop.0+0x2c/0x3b0

[ 666.319418] print_report+0xbe/0x2b0

[ 666.319421] ? mptc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References