{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26826","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.181Z","datePublished":"2024-04-17T09:43:51.741Z","dateUpdated":"2026-08-05T11:27:40.642Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:27:40.642Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix data re-injection from stale subflow\n\nWhen the MPTCP PM detects that a subflow is stale, all the packet\nscheduler must re-inject all the mptcp-level unacked data. To avoid\nacquiring unneeded locks, it first try to check if any unacked data\nis present at all in the RTX queue, but such check is currently\nbroken, as it uses TCP-specific helper on an MPTCP socket.\n\nFunnily enough fuzzers and static checkers are happy, as the accessed\nmemory still belongs to the mptcp_sock struct, and even from a\nfunctional perspective the recovery completed successfully, as\nthe short-cut test always failed.\n\nA recent unrelated TCP change - commit d5fed5addb2b (\"tcp: reorganize\ntcp_sock fast path variables\") - exposed the issue, as the tcp field\nreorganization makes the mptcp code always skip the re-inection.\n\nFix the issue dropping the bogus call: we are on a slow path, the early\noptimization proved once again to be evil."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable path is only reached from remote-peer-driven MPTCP events — stale-subflow detection when a peer stops ACKing on a path, and subflow teardown via RST/MP_TCPRST/RM_ADDR. No local access to the target is involved.\nAC:L - A malicious MPTCP peer controls every precondition: it creates the additional subflow via MP_JOIN/ADD_ADDR and then stalls or resets it while the target is sending. There is no race to win and the outcome is deterministic on affected builds.\nPR:N - The attacker is simply the remote end of an MPTCP connection to a listening service and needs no credentials or account on the target host. The stale/close handling runs on any established MPTCP connection.\nUI:N - The condition is driven entirely by the attacker's own packet behavior on an established connection. No action by a local user or administrator is required.\nS:U - The impact is confined to the MPTCP stack of the same kernel and the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The type-confused read stays within the mptcp_sock allocation and its result only selects a code path; no memory contents are returned to userspace or transmitted to the peer. There is no information disclosure.\nI:N - No memory is written out of bounds and no data in transit is corrupted — MPTCP DSS sequencing still guarantees in-order delivery, and I confirmed the RTX timer still covers fully-sent dfrags while the push path completes partially-sent ones. Nothing is silently modified.\nA:H - With re-injection disabled, recovery falls back to retransmitting a single head fragment per RTO, so an attacker who blackholes one path can indefinitely stall data transfer on the connection while the receiver is head-of-line blocked and kernel sndbuf memory stays pinned. The attacker sustains and repeats this at will across connections, amounting to a denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mptcp/protocol.c"],"versions":[{"version":"1e1d9d6f119c55c05e8ea78ed3e49046690abffd","lessThan":"6f95120f898b40d13fd441225ef511307853c9c2","status":"affected","versionType":"git"},{"version":"1e1d9d6f119c55c05e8ea78ed3e49046690abffd","lessThan":"6673d9f1c2cd984390550dbdf7d5ae07b20abbf8","status":"affected","versionType":"git"},{"version":"1e1d9d6f119c55c05e8ea78ed3e49046690abffd","lessThan":"b609c783c535493aa3fca22c7e40a120370b1ca5","status":"affected","versionType":"git"},{"version":"1e1d9d6f119c55c05e8ea78ed3e49046690abffd","lessThan":"624902eab7abcb8731b333ec73f206d38d839cd8","status":"affected","versionType":"git"},{"version":"1e1d9d6f119c55c05e8ea78ed3e49046690abffd","lessThan":"b6c620dc43ccb4e802894e54b651cf81495e9598","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mptcp/protocol.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.15.149","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.79","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.18","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.6","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.79"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.7.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2"},{"url":"https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8"},{"url":"https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5"},{"url":"https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8"},{"url":"https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598"}],"title":"mptcp: fix data re-injection from stale subflow","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:14:13.531Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26826","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:49:00.883183Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:33:30.420Z"}}]}}