CVE-2026-63867 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
mptcp: close TOCTOU race while computing rcv_wnd
The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet.
Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel relates to a time-of-check to time-of-use race condition within the Multipath TCP implementation, specifically affecting how the receiver window is computed during packet processing. This issue resides in the MPTCP subsystem where concurrent access patterns create potential inconsistencies that could be exploited by malicious actors to disrupt network communication or potentially gain unauthorized access to system resources. The vulnerability occurs when multiple threads or processes simultaneously access the MPTCP-level acknowledgment sequence number without proper synchronization mechanisms, leading to race conditions that compromise the integrity of the connection state management.
The technical flaw manifests in the MPTCP output path where the system accesses the MPTCP-level ack_seq value in a lockless manner across multiple operations. During packet processing, the system uses potentially different values for data_ack within the DSS (Data Sequence Set) option to compute the announced receive window for the same packet, creating inconsistencies that can confuse peer endpoints. This race condition arises because the receiver window calculation depends on the acknowledgment sequence number and data acknowledgment values that may change between the time of check and time of use operations. The vulnerability stems from insufficient synchronization mechanisms in the MPTCP implementation, which violates fundamental concurrency control principles and creates opportunities for inconsistent state management.
The operational impact of this vulnerability extends beyond simple connection disruption to potentially enable more sophisticated attacks against network infrastructure. When peer endpoints receive inconsistent receiver window information due to the race condition, they may misinterpret connection state, leading to packet retransmissions, connection timeouts, or even complete connection termination. This behavior can be particularly problematic in high-throughput environments where MPTCP is used for critical network services, as it could lead to service degradation or denial of service conditions that affect multiple concurrent connections. The vulnerability affects the reliability and security of multipath TCP implementations, which are increasingly deployed in enterprise networks and cloud environments.
The fix implemented addresses the core concurrency issue by refactoring the code to eliminate inconsistencies in receiver window computation and ensuring proper synchronization mechanisms are in place. This solution involves restructuring how MPTCP-level receive window updates occur, specifically ensuring that the receive window is updated only when the egress packet actually contains a DSS acknowledgment, preventing the race condition from occurring. The mitigation approach follows established best practices for concurrent programming and aligns with security standards such as those referenced in CWE-367, which addresses time-of-check to time-of-use vulnerabilities, and ATT&CK technique T1205.002 related to protocol analysis and network communication manipulation. The implementation ensures that all access patterns to the acknowledgment sequence number and receiver window values are properly synchronized, preventing the inconsistent state transitions that could lead to security implications or service disruption in multipath TCP connections.