CVE-2026-45889

kernel: mptcp: do not account for OoO in mptcp_rcvbuf_grow()

Loading…

Severity

Unknown

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · May 27, 2026

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. This vulnerability occurs due to incorrect accounting for out-of-order (OoO) data in the mptcp_rcvbuf_grow() function. A subtle and very unlikely race condition could lead to a divide-by-zero error, potentially causing a system crash (Denial of Service).

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-369 · Divide By Zero