Linux Kernel EUVD-2026-39274

The affected technology is MPTCP, the Linux kernel's Multipath TCP implementation, which spreads one logical connection across multiple TCP subflows. In MPTCP the TCP header window field encodes the MPTCP-level rcv_nxt right edge, which must not regress - a constraint enforced when generating DSS (Data Sequence Signal) options. Independently, the core TCP stack guarantees its own TCP-level receive-window right edge never moves backward. The root cause is the interaction of these two invariants: when incoming data is acknowledged at the TCP level but remains out-of-order in MPTCP sequence space (or lands in the backlog), the MPTCP window is inflated and the receiver advertises more space than rcvbuf permits. This is a window/buffer accounting defect whose root-cause class is uncontrolled resource consumption (CWE-770-like); no CWE was assigned in the input. The fix forcibly allows the TCP subflow to shrink its TCP-level receive window regardless of the netns shrink setting.