CVE-2026-43029
Soft lockup in Linux kernel MPTCP implementation
Publication date: 2026-05-01
Last updated on: 2026-05-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19.0-rc8 |
| linux_kernel | linux_kernel | 6.19.0-rc8 |
| linux | linux_kernel | to 6.19.0-rc8 (inc) |
| linux | linux_kernel | * |
| linux_kernel | mptcp | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's multipath TCP (mptcp) implementation, specifically in the mptcp_recvmsg() function.
When receiving data with the MSG_PEEK and MSG_WAITALL flags, the socket buffer (skb) is not removed from the receive queue as it should be. This causes the function sk_wait_data() to always find data available and never actually wait for new data, leading to a soft lockup where the CPU gets stuck in an infinite loop.
The fix involves adding a parameter to track the last peeked skb, allowing sk_wait_data() to make correct waiting decisions and prevent the infinite loop when MSG_PEEK is used.
How can this vulnerability impact me? :
This vulnerability can cause a soft lockup in the Linux kernel, meaning the CPU can become stuck in an infinite loop while handling certain network operations involving multipath TCP.
Such a lockup can lead to system unresponsiveness or degraded performance, potentially causing denial of service conditions on affected systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability causes a soft lockup in the Linux kernel when receiving data with MSG_PEEK | MSG_WAITALL flags, leading to the CPU being stuck. Detection involves monitoring for soft lockup warnings or CPU stalls related to mptcp_recvmsg().
You can check your system logs (e.g., dmesg or /var/log/messages) for soft lockup messages mentioning mptcp_recvmsg or CPU stuck warnings.
- Run the command: dmesg | grep -i 'soft lockup'
- Check for processes stuck in kernel mode related to mptcp_recvmsg using: ps -eo pid,comm,state,wchan | grep mptcp_recvmsg
- Monitor CPU usage and kernel stack traces for signs of infinite loops or lockups.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by a kernel patch that modifies mptcp_recvmsg() to prevent the soft lockup by properly handling MSG_PEEK | MSG_WAITALL flags.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix for this vulnerability.
- If updating is not immediately possible, avoid using applications or network operations that use MSG_PEEK combined with MSG_WAITALL flags in MPTCP sockets.
- Monitor system logs for signs of soft lockups and reboot the system if a lockup occurs.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.