Memory Management Flaw in Linux Kernel Affects MPTCP Subflow

CVE-2026-31669

What is CVE-2026-31669?

A memory management vulnerability has been identified in the Linux kernel, specifically impacting the MultiPath TCP (MPTCP) subflow mechanism. The flaw arises from improper initialization of the tcpv6_prot_override structure, which leads to child sockets being allocated via a memory cache lacking necessary safety protocols. This oversight can cause freed memory to be accessed during concurrent operations, resulting in potential stability issues and exposure to exploitation through slab-use-after-free scenarios. The issue has been addressed by implementing a separate initialization function to ensure correct memory handling during protocol setup, thereby securing the integrity of socket memory during operation.

References