Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the receive queue do not trigger forward-allocated memory reclaiming. Prevent forward memory from growing unboundedly in pathological drop scenarios by explicitly reclaiming memory when skbs are dropped.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T15:17:15.180Z",
  "pubdate": "2026-08-26T15:17:15.180Z",
  "executiveSummary": "This vulnerability involves a memory leak within the Linux kernel MPTCP (Multi-Path TCP) subsystem occurring during the receive path.\nThe issue stems from improper handling of forward-allocated memory when skbs are dropped prior to being queued in the receive buffer.\nThis affects MPTCP implementations post-commit 9db5b3cec4ec, where logic changes caused the system to fail to reclaim memory during specific error conditions.\nThe primary risk is a potential kernel-level resource exhaustion (Denial of Service) caused by unbound growth of forward-allocated memory during pathological packet drop scenarios.\nAn attacker capable of triggering frequent, intentional packet drops or specific error conditions within the MPTCP subflow can force the kernel to leak memory, eventually leading to system instability or memory pressure.\nNo specific authentication is required to initiate these network-based sequences, making the system vulnerable to remote exploitation by entities capable of sending malformed or drop-inducing traffic.",
  "technicalDetails": "The vulnerability originates from a deficiency in the MPTCP memory accounting logic introduced after commit 9db5b3cec4ec ('mptcp: borrow forward memory from subflow').\nIn the Linux kernel network stack, forward allocation is used to optimize memory usage by pre-allocating buffer space for incoming packets before they are finalized into the receive queue. Under normal conditions, when an skb is either successfully queued or dropped after being accounted for, the system should trigger a release or reclamation of the associated forward-allocated memory.\nThe identified flaw occurs when an error is triggered during the receive path processing before the skb is officially committed to the receive queue. Due to the logic flow changes, the kernel fails to explicitly invoke the reclamation routines for memory that had been previously borrowed or forward-allocated for these specific skbs.\nAn attacker can exploit this by flooding an MPTCP subflow with packets crafted to trigger early-path errors, such as checksum failures, out-of-order sequence issues, or other conditions that cause the kernel to discard the packet before it reaches the socket receive queue.\nBecause the kernel neglects to reclaim the forward-allocated memory associated with these discarded packets, the 'fwd_alloc' counter for the socket continues to grow unchecked. In a pathological scenario, a continuous stream of such packets leads to the exhaustion of the kernel's memory budget, potentially impacting other network operations or causing kernel-level memory management failures.\nThe exploit flow involves: 1. Establishing an MPTCP connection. 2. Sending a sequence of network packets designed to fail validation checks in the early RX path. 3. Observing that the kernel allocates memory for these packets but fails to decrement the forward allocation tracking upon the drop event. 4. Sustaining this activity until the system reaches memory exhaustion thresholds. This vulnerability persists across the affected kernel versions until explicitly patched to ensure that error-path handling correctly invokes the memory reclamation routine for all pending forward-allocated buffers."
}