CVE-2026-53183

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. This vulnerability occurs because the TCP stack independently manages the TCP-level receive window, which can lead to an artificial inflation of the MPTCP receive window. A remote attacker could exploit this by sending specific traffic, causing the incoming data to exceed the receiver's buffer size. This can result in a Denial of Service (DoS) condition, making the system unresponsive to legitimate traffic.

This vulnerability is rated as Moderate impact because triggering it requires an active Multipath TCP (MPTCP) connection on the host. In typical Red Hat Enterprise Linux environments, standard network services do not use MPTCP unless explicitly configured by applications or wrappers like mptcpize. Furthermore, the flaw only leads to resource exhaustion and denial of service via memory consumption, without compromising data confidentiality or system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.