In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: userspace: fix use-after-free in get_local_id
In mptcp_pm_userspace_get_local_id(), the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the unlock and the read, leading to UAF.
The race window is narrow. It was reproduced only with a locally constructed stress test that repeatedly overlaps an MP_JOIN SYN with a MPTCP_PM_CMD_SUBFLOW_DESTROY request.
However, the KASAN report below confirms that the race is reachable:
[ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0 ... [ 666.319401] Call Trace: [ 666.319405] <IRQ> [ 666.319408] dump_stack_lvl+0x53/0x70 [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0 [ 666.319418] print_report+0xbe/0x2b0 [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319423] kasan_report+0xce/0x100 [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319433] mptcp_pm_get_local_id+0x371/0x440 ... [ 666.319821] Allocated by task 45539: [ 666.319844] kasan_save_stack+0x33/0x60 [ 666.319855] kasan_save_track+0x14/0x30 [ 666.319858] __kasan_kmalloc+0x8f/0xa0 [ 666.319863] __kmalloc_noprof+0x1e7/0x520 [ 666.319867] sock_kmalloc+0xdf/0x130 [ 666.319885] sock_kmemdup+0x1b/0x40 [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500 [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610 ... [ 666.319967] Freed by task 45560: [ 666.319988] kasan_save_stack+0x33/0x60 [ 666.319991] kasan_save_track+0x14/0x30 [ 666.319994] kasan_save_free_info+0x3b/0x60 [ 666.319998] __kasan_slab_free+0x43/0x70 [ 666.320000] kfree+0x166/0x440 [ 666.320003] sock_kfree_s+0x1d/0x50 [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200 [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0
Fix by copying the id into a local variable while still holding the lock, and use -1 as a "not found" sentinel.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade microvm-kernel6.18Upgrade bpftool6.18Upgrade kernel6.12-tools-debuginfoUpgrade kernel6.18-modules-extraUpgrade kernel6.18-tools-debuginfoUpgrade perf6.12Upgrade kernel6.12-debuginfoUpgrade kernel6.12-headersUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel-livepatch-6.12.103-127.188Upgrade python3-perf6.18-debuginfoUpgrade kernel6.12-toolsUpgrade perf6.18Upgrade kernel6.18-tools-develUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18Upgrade kernel6.18-develUpgrade python3-perf6.18Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.12-tools-develUpgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel6.12-debuginfo-common-x86_64Upgrade bpftool6.12Upgrade kernel-livepatch-6.18.44-99.149Upgrade kernel6.18-toolsUpgrade kernel6.12-modules-extra-commonUpgrade perf6.18-debuginfoUpgrade bpftool6.18-debuginfoUpgrade bpftool6.12-debuginfoUpgrade python3-perf6.12Upgrade kernel6.12-modules-extraUpgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.18-headersUpgrade kernel6.18-debuginfoUpgrade kernel6.12 | Sep 1, 2026 | Aug 10, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Aug 26, 2026 | Aug 26, 2026 |
| Redhat_linux | — | No solution exists | Aug 13, 2026 | Aug 10, 2026 |
| Ubuntu | — | Upgrade linux-image-gcp-64kUpgrade linux-image-ibmUpgrade linux-image-aws-7.0Upgrade linux-image-azure-lts-26.04Upgrade linux-image-virtual-7.0Upgrade linux-image-gke-64k-7.0Upgrade linux-image-gke-7.0Upgrade linux-image-gcp-7.0Upgrade linux-image-7.0.0-38-realtimeUpgrade linux-image-genericUpgrade linux-image-gke-64kUpgrade linux-image-ibm-7.0Upgrade linux-image-oem-26.04Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-gke-hwe-26.04Upgrade linux-image-7.0.0-38-realtime-64kUpgrade linux-image-azure-fdeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-7.0.0-1013-oracle-64kUpgrade linux-image-7.0.0-1016-azure-fdeUpgrade linux-image-oem-26.04aUpgrade linux-image-oracleUpgrade linux-image-aws-64k-7.0Upgrade linux-image-7.0.0-1015-ibmUpgrade linux-image-realtime-7.0Upgrade linux-image-azure-fde-7.0Upgrade linux-image-7.0.0-1013-oracleUpgrade linux-image-azure-fde-lts-26.04Upgrade linux-image-gcpUpgrade linux-image-aws-64kUpgrade linux-image-7.0.0-1014-awsUpgrade linux-image-virtual-hwe-26.04Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-generic-7.0Upgrade linux-image-gkeUpgrade linux-image-oem-7.0Upgrade linux-image-realtime-64kUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-generic-64k-7.0Upgrade linux-image-7.0.0-1008-gkeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-azure-7.0Upgrade linux-image-7.0.0-1015-oemUpgrade linux-image-7.0.0-1008-gke-64kUpgrade linux-image-7.0.0-38-generic-64kUpgrade linux-image-7.0.0-1017-azureUpgrade linux-image-oracle-7.0Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-generic-hwe-26.04Upgrade linux-image-7.0.0-1014-aws-64kUpgrade linux-image-7.0.0-1014-gcp-64kUpgrade linux-image-virtualUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-awsUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-7.0.0-1014-gcpUpgrade linux-image-7.0.0-38-genericUpgrade linux-image-realtimeUpgrade linux-image-azureUpgrade linux-image-generic-64k | Oct 7, 2026 | Oct 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 17, 2026 | Aug 10, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub