CVE-2026-31669

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. Due to incorrect memory allocation for IPv6 subflow child sockets, a use-after-free vulnerability exists. A remote attacker could exploit this by triggering concurrent lookups in the kernel's hash table, potentially leading to a denial of service or arbitrary code execution.

A slab use after free can occur in the MPTCP IPv6 subflow path because tcpv6_prot_override may end up with a NULL slab cache pointer and child sockets are then allocated from a non RCU safe kmalloc cache. Lockless ehash lookups rely on SLAB_TYPESAFE_BY_RCU for socket memory stability under rcu_read_lock. When the affected sockets are freed without SOCK_RCU_FREE the memory can be reused immediately and a concurrent __inet_lookup_established lookup can access freed memory. This is at least a denial of service via kernel crash and it is a memory corruption class issue that may allow confidentiality or integrity impact in a worst case scenario. The issue can be network reachable via MPTCP over IPv6, but there is no known attack scenario for now. There is no confirmed practical trigger scenario under default configurations. It appears to require specific non-default preconditions (MPTCP/IPv6 runtime conditions and vulnerable child socket creation paths) that are not known to be reachable by default, so this is the reason to keep this one "Moderate" impact level.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.