CVE-2024-26826: mptcp: fix data re-injection from stale subflow
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix data re-injection from stale subflow
When the MPTCP PM detects that a subflow is stale, all the packet
scheduler must re-inject all the mptcp-level unacked data. To avoid
acquiring unneeded locks, it first try to check if any unacked data
is present at all in the RTX queue, but such check is currently
broken, as it uses TCP-specific helper on an MPTCP socket.
Funnily enough fuzzers and static checkers are happy, as the accessed
memory still belongs to the mptcp_sock struct, and even from a
functional perspective the recovery completed successfully, as
the short-cut test always failed.
A recent unrelated TCP change - commit d5fed5addb2b ("tcp: reorganize
tcp_sock fast path variables") - exposed the issue, as the tcp field
reorganization makes the mptcp code always skip the re-inection.
Fix the issue dropping the bogus call: we are on a slow path, the early
optimization proved once again to be evil.
Security readout for executives and security teams
Plain-English summary
A Linux MPTCP flaw can prevent unacknowledged data from being resent when a network subflow becomes stale. This can disrupt an MPTCP connection and affect service availability. The supplied CVSS score is 7.5, reflecting remotely reachable, low-complexity availability impact without required privileges or user interaction.
Executive priority
Treat as a high-priority availability issue for systems that depend on MPTCP, especially critical network services. Patch during the next expedited maintenance window after vendor compatibility testing. Priority can be lower where MPTCP is demonstrably disabled or unused. There is no supplied evidence of active exploitation.
Technical view
MPTCP’s stale-subflow recovery incorrectly called a TCP-specific helper on an MPTCP socket. After an unrelated TCP structure reorganization, that check could incorrectly bypass retransmission-queue reinjection, leaving MPTCP-level unacknowledged data unsent. The kernel fix removes the invalid shortcut check from this slow path.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions where MPTCP is enabled and used. The bundle identifies affected 5.15, 6.1, 6.6, 6.7, and 6.8 lines, but does not provide distribution package mappings. Systems not using MPTCP are unlikely to exercise the vulnerable path.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no source establishes active exploitation or a public exploit. The failure requires MPTCP stale-subflow recovery conditions. Although CVSS marks the issue network-reachable, the supplied evidence does not establish how reliably an unauthenticated attacker can induce those conditions.
Researcher notes
The affected-version data lacks CPEs and clear distribution package boundaries. The description says earlier behavior still recovered because the faulty shortcut always failed; TCP commit d5fed5addb2b exposed the defect by making reinjection get skipped. No CWE is assigned. Researchers should distinguish vulnerable source ancestry from vendor backport status.
Mitigation direction
Apply the appropriate Linux stable update containing the referenced kernel fix.
Check distribution security guidance for corrected kernel package versions.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-26826 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.