CVE-2026-63867

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. A race condition exists when computing the receive window, where the acknowledgment sequence number is accessed without proper locking. This can lead to inconsistencies in how the receive window is calculated and communicated to a peer, potentially causing connection instability or disruption.

Red Hat has classified this vulnerability as Moderate severity because exploitation is confined to connection desynchronization or denial of service without permitting privilege escalation or data exposure. The flaw only affects environments actively utilizing Multipath TCP (MPTCP) sockets, which are not configured by default for standard networking services. Consequently, systems running conventional TCP workloads remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.