CVE-2026-31669 mptcp: fix slab-use-after-free in __inet_lookup_established
A use-after-free in the Linux kernel MPTCP subsystem allows attackers to execute arbitrary code or escalate privileges via concurrent network lookups.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31669?
CVE-2026-31669 is a critical use after free vulnerability in Linux kernel, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix slab-use-after-free in __inet_lookup_established
The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side critical sections. Both tcp_prot and tcpv6_prot have their slab caches created with this flag via proto_register().
However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override during inet_init() (fs_initcall, level 5), before inet6_init() (module_init/device_initcall, level 6) has called proto_register(&tcpv6_prot). At that point, tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab remains NULL permanently.
This causes MPTCP v6 subflow child sockets to be allocated via kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so when these sockets are freed without SOCK_RCU_FREE (which is cleared for child sockets by design), the memory can be immediately reused. Concurrent ehash lookups under rcu_read_lock can then access freed memory, triggering a slab-use-after-free in __inet_lookup_established.
Fix this by splitting the IPv6-specific initialization out of mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called from mptcp_proto_v6_init() before protocol registration. This ensures tcpv6_prot_override.slab correctly inherits the SLAB_TYPESAFE_BY_RCU slab cache.
Weakness: CWE-416
Which versions are affected by CVE-2026-31669?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31669?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-31669 being exploited?
There is no known exploitation of CVE-2026-31669 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83837, BELL-CVE-2026-31669, DEBIAN-CVE-2026-31669, GHSA-29w7-pv74-wpq7, ROOT-OS-DEBIAN-12-CVE-2026-31669, ROOT-OS-DEBIAN-13-CVE-2026-31669 and 3 more.