CVE-2026-68170

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

CVE-2026-68170 mptcp: fix stale skb->sk reference on subflow close

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

CVE-2026-68170

The CVE-2026-68170 issue affects the Linux kernel MPTCP backlog handling. The bug allowed a backlog entry to reference an ssk that might be freed due to cleanup occurring in mptcp_close_ssk() without holding the ssk lock or mptcp_data_lock. The fix moves the backlog cleanup into __mptcp_close_ssk...