CVE-2026-63867 mptcp: close TOCTOU race while computing rcv_wnd
A race condition in the Linux kernel MPTCP implementation can cause inconsistent window announcements, potentially confusing peers and leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63867?
CVE-2026-63867 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: close TOCTOU race while computing rcv_wnd
The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet.
Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.
Which versions are affected by CVE-2026-63867?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-63867?
Apply the vendor's patch.
Is CVE-2026-63867 being exploited?
There is no known exploitation of CVE-2026-63867 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-63867, DEBIAN-CVE-2026-63867, GHSA-wqpm-3qh2-7cxj, ROOT-OS-UBUNTU-2204-CVE-2026-63867, UBUNTU-CVE-2026-63867.