EUVD-2026-66503
GHSA-82qc-q32m-354f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-triggered memory exhaustion via MPTCP with no authentication required; impact is availability only, no confidentiality or integrity exposure.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mptcp: reclaim forward-allocated memory on RX path errors
After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the receive queue do not trigger forward-allocated memory reclaiming.
Prevent forward memory from growing unboundedly in pathological drop scenarios by explicitly reclaiming memory when skbs are dropped.
AnalysisAI
Memory exhaustion in the Linux kernel's MPTCP (Multipath TCP) subsystem allows unauthenticated remote attackers to drive forward-allocated memory growth without bound, resulting in kernel memory exhaustion and denial of service. The flaw is a regression introduced by commit 9db5b3cec4ec, which added forward-memory borrowing from MPTCP subflows but omitted the corresponding reclaim step when socket buffers are dropped before reaching the receive queue. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | MPTCP must be enabled on the target kernel (net.mptcp.enabled=1) and the attacker must be able to establish or influence MPTCP connections to the target - either by connecting directly to an MPTCP-listening service or by being on a network path that allows packet injection into existing MPTCP sessions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 (High), reflecting unauthenticated network access with high availability impact and no confidentiality or integrity exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker establishes one or more MPTCP connections to a vulnerable Linux server and transmits crafted packet sequences engineered to repeatedly trigger skb drops in the MPTCP receive path before buffers reach the receive queue. Each drop event leaves forward-allocated memory unreleased; sustained over time this causes kernel memory to grow unboundedly, eventually exhausting available memory and producing an OOM condition or system hang that denies service to all users. |
| Remediation | The primary fix is upgrading to a patched kernel: 6.18.46 or later for the 6.18.x stable series, 7.1.10 or later for the 7.1.x series, or kernel 7.2+ for mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux kernel versions 6.18.x and 7.1.x series and assess MPTCP workload exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today