CVE-2026-63867
Received Received - Intake

MPTCP TOCTOU Race in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63867
EUVD
EUVD-2026-45552

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a time-of-check to time-of-use (TOCTOU) race condition in the Multipath TCP (MPTCP) implementation. The issue occurs when the kernel access the MPTCP-level ack_seq multiple times without proper locking, leading to potential inconsistencies in the data_ack value used in the DSS option and the rcv_wnd calculation for the same packet.

Detection Guidance

This vulnerability is specific to the Linux kernel's MPTCP implementation and involves a race condition in handling acknowledgments. Detection typically requires kernel-level inspection rather than network commands. Check kernel logs for MPTCP-related errors or warnings using dmesg | grep mptcp. Verify if your kernel version includes the fix by running uname -r and comparing against patched versions. Monitor network traffic for inconsistent DSS options or rcv_wnd values using tools like tcpdump or Wireshark.

Impact Analysis

This vulnerability could allow an attacker to manipulate MPTCP communication by causing inconsistencies in sequence numbers and receive window calculations. This might lead to data corruption, connection resets, or denial of service in systems using MPTCP for network communication.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel networking issue rather than data protection or privacy controls.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the MPTCP TOCTOU race condition. Monitor kernel security advisories for updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart