CVE-2026-68169
mptcp: pm: userspace: fix use-after-free in get_local_id
Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in get_local_id In mptcp_pm_userspace_get_local_id(), the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the unlock and the read, leading to UAF. The race window is narrow. It was reproduced only with a locally constructed stress test that repeatedly overlaps an MP_JOIN SYN with a MPTCP_PM_CMD_SUBFLOW_DESTROY request. However, the KASAN report below confirms that the race is reachable: [ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0 ... [ 666.319401] Call Trace: [ 666.319405] <IRQ> [ 666.319408] dump_stack_lvl+0x53/0x70 [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0 [ 666.319418] print_report+0xbe/0x2b0 [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319423] kasan_report+0xce/0x100 [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319433] mptcp_pm_get_local_id+0x371/0x440 ... [ 666.319821] Allocated by task 45539: [ 666.319844] kasan_save_stack+0x33/0x60 [ 666.319855] kasan_save_track+0x14/0x30 [ 666.319858] __kasan_kmalloc+0x8f/0xa0 [ 666.319863] __kmalloc_noprof+0x1e7/0x520 [ 666.319867] sock_kmalloc+0xdf/0x130 [ 666.319885] sock_kmemdup+0x1b/0x40 [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500 [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610 ... [ 666.319967] Freed by task 45560: [ 666.319988] kasan_save_stack+0x33/0x60 [ 666.319991] kasan_save_track+0x14/0x30 [ 666.319994] kasan_save_free_info+0x3b/0x60 [ 666.319998] __kasan_slab_free+0x43/0x70 [ 666.320000] kfree+0x166/0x440 [ 666.320003] sock_kfree_s+0x1d/0x50 [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200 [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0 Fix by copying the id into a local variable while still holding the lock, and use -1 as a "not found" sentinel.
INFO
Published Date :
Aug. 10, 2026, 1:20 p.m.
Last Modified :
Aug. 17, 2026, 5:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Copy ID to local variable while holding lock.
- Use -1 as sentinel for not found.
- Apply patch to the Linux kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68169.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68169 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68169
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68169 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68169 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ed34dfa19ddbd1e4c85a73636f8cba0211025ea4', 'lessThan': 'd2c3760b45f2f481a4dd4c5adef4a29dfabd948f', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': '31ce5af66891f79998fb2e8b8df08e3c98fd72e3', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': 'd64f6c02495f3fad674038cfa7ec049671b59e7b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': '40dde4b5d98279471a70e5c8bb713182738c00d9', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': '9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e373bfc8ec3d6496ec7e11dd7f4d087a44b1009a', 'versionType': 'git'}, {'status': 'affected', 'version': '005a3ad289eb604216dcaa03646de36cb08624a0', 'versionType': 'git'}, {'status': 'affected', 'version': '6.6.18', 'lessThan': '6.6.151', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.79', 'lessThan': '6.2', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.7.6', 'lessThan': '6.8', 'versionType': 'semver'}], 'programFiles': ['net/mptcp/pm_userspace.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/mptcp/pm_userspace.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ed34dfa19ddbd1e4c85a73636f8cba0211025ea4', 'lessThan': 'd2c3760b45f2f481a4dd4c5adef4a29dfabd948f', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': '31ce5af66891f79998fb2e8b8df08e3c98fd72e3', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': 'd64f6c02495f3fad674038cfa7ec049671b59e7b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': '40dde4b5d98279471a70e5c8bb713182738c00d9', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': '9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e373bfc8ec3d6496ec7e11dd7f4d087a44b1009a', 'versionType': 'git'}, {'status': 'affected', 'version': '005a3ad289eb604216dcaa03646de36cb08624a0', 'versionType': 'git'}, {'status': 'affected', 'version': '6.6.18', 'lessThan': '6.6.151', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.79', 'lessThan': '6.2', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.7.6', 'lessThan': '6.8', 'versionType': 'semver'}], 'programFiles': ['net/mptcp/pm_userspace.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/mptcp/pm_userspace.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 10, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ed34dfa19ddbd1e4c85a73636f8cba0211025ea4', 'lessThan': 'd2c3760b45f2f481a4dd4c5adef4a29dfabd948f', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': '31ce5af66891f79998fb2e8b8df08e3c98fd72e3', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': 'd64f6c02495f3fad674038cfa7ec049671b59e7b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': '40dde4b5d98279471a70e5c8bb713182738c00d9', 'versionType': 'git'}, {'status': 'affected', 'version': 'f012d796a6de662692159c539689e47e662853a8', 'lessThan': '9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e373bfc8ec3d6496ec7e11dd7f4d087a44b1009a', 'versionType': 'git'}, {'status': 'affected', 'version': '005a3ad289eb604216dcaa03646de36cb08624a0', 'versionType': 'git'}, {'status': 'affected', 'version': '6.6.18', 'lessThan': '6.6.151', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.79', 'lessThan': '6.2', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.7.6', 'lessThan': '6.8', 'versionType': 'semver'}], 'programFiles': ['net/mptcp/pm_userspace.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/mptcp/pm_userspace.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in get_local_id In mptcp_pm_userspace_get_local_id(), the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the unlock and the read, leading to UAF. The race window is narrow. It was reproduced only with a locally constructed stress test that repeatedly overlaps an MP_JOIN SYN with a MPTCP_PM_CMD_SUBFLOW_DESTROY request. However, the KASAN report below confirms that the race is reachable: [ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0 ... [ 666.319401] Call Trace: [ 666.319405] <IRQ> [ 666.319408] dump_stack_lvl+0x53/0x70 [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0 [ 666.319418] print_report+0xbe/0x2b0 [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319423] kasan_report+0xce/0x100 [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319433] mptcp_pm_get_local_id+0x371/0x440 ... [ 666.319821] Allocated by task 45539: [ 666.319844] kasan_save_stack+0x33/0x60 [ 666.319855] kasan_save_track+0x14/0x30 [ 666.319858] __kasan_kmalloc+0x8f/0xa0 [ 666.319863] __kmalloc_noprof+0x1e7/0x520 [ 666.319867] sock_kmalloc+0xdf/0x130 [ 666.319885] sock_kmemdup+0x1b/0x40 [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500 [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610 ... [ 666.319967] Freed by task 45560: [ 666.319988] kasan_save_stack+0x33/0x60 [ 666.319991] kasan_save_track+0x14/0x30 [ 666.319994] kasan_save_free_info+0x3b/0x60 [ 666.319998] __kasan_slab_free+0x43/0x70 [ 666.320000] kfree+0x166/0x440 [ 666.320003] sock_kfree_s+0x1d/0x50 [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200 [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0 Fix by copying the id into a local variable while still holding the lock, and use -1 as a "not found" sentinel. Added Reference https://git.kernel.org/stable/c/31ce5af66891f79998fb2e8b8df08e3c98fd72e3 Added Reference https://git.kernel.org/stable/c/40dde4b5d98279471a70e5c8bb713182738c00d9 Added Reference https://git.kernel.org/stable/c/9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9 Added Reference https://git.kernel.org/stable/c/d2c3760b45f2f481a4dd4c5adef4a29dfabd948f Added Reference https://git.kernel.org/stable/c/d64f6c02495f3fad674038cfa7ec049671b59e7b