CVE-2026-68170

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) feature. A timing issue, or race condition, can occur when a subflow is being closed, leading to a situation where the system attempts to use memory that has already been freed. This 'use-after-free' vulnerability arises because concurrent network data processing might interact improperly with the cleanup process. An attacker could potentially exploit this to cause a system crash (denial of service).

This issue affects Multipath TCP (MPTCP). Subflow close can leave stale skb->sk references in the backlog when cleanup races with mptcp_data_ready(). Systems not using MPTCP are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.