CVE-2026-53183

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mptcp: allow subflow rcv wnd to shrink<br /> <br /> In MPTCP connection, the `window` field in the TCP header refers to the<br /> MPTCP-level rcv_nxt and it&amp;#39;s right edge should not move backward. Such<br /> constraint is enforced at DSS option generation time.<br /> <br /> At the same time, the TCP stack ensures independently that the TCP-level<br /> rcv wnd right&amp;#39;s edge does not move backward. That in turn causes artificial<br /> inflating of the MPTCP rcv window when the incoming data is acked at the<br /> TCP level and is OoO in the MPTCP sequence space (or lands in the backlog).<br /> <br /> As a consequence, the incoming traffic can exceed the receiver rcvbuf size<br /> even when the sender is not misbehaving.<br /> <br /> Prevent such scenario forcibly allowing the TCP subflow to shrink the<br /> TCP-level rcv wnd regardless of the current netns setting.