CVE-2026-68169

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mptcp: pm: userspace: fix use-after-free in get_local_id<br /> <br /> In mptcp_pm_userspace_get_local_id(), the address entry is looked up under<br /> spinlock, but its id is read after dropping the lock. A concurrent deletion<br /> can free the entry between the unlock and the read, leading to UAF.<br /> <br /> The race window is narrow. It was reproduced only with a locally<br /> constructed stress test that repeatedly overlaps an MP_JOIN SYN with a<br /> MPTCP_PM_CMD_SUBFLOW_DESTROY request.<br /> <br /> However, the KASAN report below confirms that the race is reachable:<br /> <br /> [ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0<br /> [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0<br /> ...<br /> [ 666.319401] Call Trace:<br /> [ 666.319405] <br /> [ 666.319408] dump_stack_lvl+0x53/0x70<br /> [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0<br /> [ 666.319418] print_report+0xbe/0x2b0<br /> [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0<br /> [ 666.319423] kasan_report+0xce/0x100<br /> [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0<br /> [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0<br /> [ 666.319433] mptcp_pm_get_local_id+0x371/0x440<br /> ...<br /> [ 666.319821] Allocated by task 45539:<br /> [ 666.319844] kasan_save_stack+0x33/0x60<br /> [ 666.319855] kasan_save_track+0x14/0x30<br /> [ 666.319858] __kasan_kmalloc+0x8f/0xa0<br /> [ 666.319863] __kmalloc_noprof+0x1e7/0x520<br /> [ 666.319867] sock_kmalloc+0xdf/0x130<br /> [ 666.319885] sock_kmemdup+0x1b/0x40<br /> [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500<br /> [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610<br /> ...<br /> [ 666.319967] Freed by task 45560:<br /> [ 666.319988] kasan_save_stack+0x33/0x60<br /> [ 666.319991] kasan_save_track+0x14/0x30<br /> [ 666.319994] kasan_save_free_info+0x3b/0x60<br /> [ 666.319998] __kasan_slab_free+0x43/0x70<br /> [ 666.320000] kfree+0x166/0x440<br /> [ 666.320003] sock_kfree_s+0x1d/0x50<br /> [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200<br /> [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0<br /> <br /> Fix by copying the id into a local variable while still holding the lock,<br /> and use -1 as a "not found" sentinel.