Skip to main content

Linux Kernel EUVDEUVD-2026-45552

| CVE-2026-63867 HIGH
2026-07-19 Linux GHSA-wqpm-3qh2-7cxj
Information Disclosure Linux
High
Disputed · 8.2 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
vuln.today AI
6.5 MEDIUM

Remote unauthenticated network reach (AV:N/PR:N/UI:N) but winning a TOCTOU race warrants AC:H; impact is peer confusion/availability (A:H) with minor integrity (I:L), no disclosure (C:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
3.7 LOW
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:01 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.2 (HIGH)
Patch available
Jul 19, 2026 - 16:19 EUVD
CVE Published
Jul 19, 2026 - 14:18 cve.org
HIGH 8.2
CVE Published
Jul 19, 2026 - 14:18 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mptcp: close TOCTOU race while computing rcv_wnd

The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet.

Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.

AnalysisAI

Availability degradation in the Linux kernel's MPTCP (Multipath TCP) subsystem allows remote peers to trigger connection-level inconsistencies through a time-of-check-to-time-of-use (TOCTOU) race in the transmit path. The MPTCP output code reads the connection-level ack_seq locklessly and multiple times per packet, so the data_ack value placed in the DSS option can diverge from the value used to compute the announced receive window, confusing the remote peer and destabilizing the multipath connection. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the flaw is not in CISA KEV.

Technical ContextAI

The affected component is the kernel's MPTCP implementation (net/mptcp), which extends TCP to carry a single logical data stream across multiple subflows. MPTCP tracks a connection-level sequence space via the Data Sequence Signal (DSS) option, and the receiver advertises a connection-level receive window (rcv_wnd) that must stay coherent with the acknowledged data sequence (ack_seq). The root cause is a concurrency/consistency bug (functionally CWE-367 TOCTOU / CWE-362 race condition, though NVD lists CWE as N/A): the output path accesses the shared ack_seq without holding a consistent lock and re-reads it, so a single egress packet can carry a data_ack in its DSS option that no longer matches the rcv_wnd computed from a different read of the same field. The fix refactors the code to snapshot the value once and to update the MPTCP-level rcv_wnd only when the outgoing packet actually carries a DSS ack.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 (or later on the corresponding branch), or apply the backport commit for your tree from https://git.kernel.org/stable/c/8f4f0a157e8436a05bf8c3670b24dbc258911c43 and the related stable commits. As a compensating control where patching must wait, disable MPTCP if it is not required - either set net.mptcp.enabled=0 via sysctl or avoid building/loading the mptcp functionality - which closes the exposure entirely at the cost of losing multipath connectivity for any application relying on it. If MPTCP is required, restrict which services negotiate it and limit exposure of MPTCP-enabled listeners to untrusted networks; note this only reduces, not eliminates, the attack surface. Track the fix via https://nvd.nist.gov/vuln/detail/CVE-2026-63867.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45552 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy