HIGH
mptcp RxDrop Leak
CVE-2026-80588
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the receive queue do not trigger forward-allocated memory reclaiming. Prevent forward memory from growing unboundedly in pathological drop scenarios by explicitly reclaiming memory when skbs are dropped.
02KernelScan AI Analysis
Risk summary
A remote attacker can send crafted MPTCP traffic that triggers receive-path errors, causing the kernel to leak forward-allocated memory without bound. Repeated exploitation can exhaust system memory and cause denial of service. Any network peer that can reach the target over TCP can trigger this with no privileges required.
Vulnerability analysis
The MPTCP receive path borrows forward-allocated memory from subflow sockets for efficiency, but when incoming packets are dropped due to errors before being queued for delivery, that borrowed memory is never returned to the system. The normal automatic reclaim path does not fire because the packets were abandoned before cleanup had been configured. An attacker who can send MPTCP traffic to the target can trigger these drop conditions repeatedly, causing forward-allocated memory to grow without bound and eventually exhausting system memory. The fix ensures the borrowed forward memory is explicitly returned whenever a packet is discarded before queuing, closing the leak on the error path. Any remote peer that can reach the target over the network can trigger this vulnerability; no special privileges or local access are required, though the target must have MPTCP enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18.35 | 6.18.46 | 473f1a5ab2ab |
| 7.1 | — | 7.1.10 | 8277f48a06d3 |
| mainline | — | 7.2 | 41b49a8b914e |