Loading vulnerability…
Use-after-free in Linux kernel MPTCP IPv6 socket lookups
CVE-2026-31669 is a slab use-after-free vulnerability in the Linux kernel's MPTCP IPv6 subflow handling, affecting __inet_lookup_established(). During initialization, mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override before IPv6 protocol registration has initialized tcpv6_prot.slab. The override consequently retains a NULL slab pointer, causing IPv6 MPTCP subflow child sockets to be allocated from kmalloc-4k rather than the TCPv6 slab cache. Unlike the TCPv6 cache, kmalloc-4k lacks SLAB_TYPESAFE_BY_RCU protection. Because child sockets have SOCK_RCU_FREE cleared by design, their memory can be immediately reused after freeing. Concurrent lockless established-socket hash-table lookups within RCU read-side critical sections can therefore access freed socket memory, potentially causing a kernel crash or denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Concurrent established-socket lookups can dereference freed and potentially reused kernel memory, violating the memory-lifetime guarantees required by the networking subsystem. This can cause kernel faults and potentially system-wide denial of service. Arbitrary code execution, privilege escalation, and information disclosure have not been established for this vulnerability.
If you can’t patch tonight, do this now.
No vendor workaround is specified. Where operationally feasible pending a kernel update, disable MPTCP or avoid IPv6 MPTCP subflows to remove the affected socket-allocation path.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the MPTCP IPv6 initialization fix and reboot into the corrected kernel. The fix moves IPv6-specific initialization from mptcp_subflow_init() into mptcp_subflow_v6_init(), invoked by mptcp_proto_v6_init() before MPTCP IPv6 protocol registration, ensuring that tcpv6_prot_override inherits the initialized TCPv6 slab cache with SLAB_TYPESAFE_BY_RCU protection. Applicable Red Hat updates include RHSA-2026:26427 for RHEL 8, RHSA-2026:26428 for RHEL 8 kernel-rt, RHSA-2026:27789 for RHEL 9, and RHSA-2026:27288 for RHEL 10; other supported streams have separate advisories. Affected Tanzu Ubuntu Jammy stemcells have fixes in release 1.1282.x.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.