CVE-2026-63867

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.

CVSS 3.1

8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-25)

CWE

CWE-362

Published

2026-07-19

Modified

2026-10-19

Record from

the NVD, synced 2026-10-21

References

• https://git.kernel.org/stable/c/301a33fd590c408a05c5df800e0cc1e6a8a2f8f8
• https://git.kernel.org/stable/c/3b8cbba7c0ed31189c89f90be247b8973ffa79ef
• https://git.kernel.org/stable/c/68364963e5baf03f16b4420292291f75c8f66497
• https://git.kernel.org/stable/c/8ab24fdebc369c0dfb90f82c1650b1e66662bb45
• https://git.kernel.org/stable/c/8f4f0a157e8436a05bf8c3670b24dbc258911c43

Check your stackJSON