---
id: CVE-2026-63867
title: 'mptcp: close TOCTOU race while computing rcv_wnd'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mptcp: close TOCTOU race while computing rcv_wnd

  The MPTCP output path access locklessly the MPTCP-level ack_seq
  in multiple times, using possibly different values for…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 <
    301a33fd590c408a05c5df800e0cc1e6a8a2f8f8
  - >-
    Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 <
    68364963e5baf03f16b4420292291f75c8f66497
  - >-
    Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 <
    907ac6b1658e0277f979fcdfae2a753b495c1510
  - >-
    Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 <
    c4f4cf60797974873dbc8e100144682a6f2f861f
  - >-
    Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 <
    3b8cbba7c0ed31189c89f90be247b8973ffa79ef
  - >-
    Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 <
    8f4f0a157e8436a05bf8c3670b24dbc258911c43
  - >-
    Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 <
    8ab24fdebc369c0dfb90f82c1650b1e66662bb45
  - Linux 5.11
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:32:35.077407Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:08.860Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63867'
references:
  - url: 'https://git.kernel.org/stable/c/301a33fd590c408a05c5df800e0cc1e6a8a2f8f8'
  - url: 'https://git.kernel.org/stable/c/68364963e5baf03f16b4420292291f75c8f66497'
  - url: 'https://git.kernel.org/stable/c/907ac6b1658e0277f979fcdfae2a753b495c1510'
  - url: 'https://git.kernel.org/stable/c/c4f4cf60797974873dbc8e100144682a6f2f861f'
  - url: 'https://git.kernel.org/stable/c/3b8cbba7c0ed31189c89f90be247b8973ffa79ef'
  - url: 'https://git.kernel.org/stable/c/8f4f0a157e8436a05bf8c3670b24dbc258911c43'
  - url: 'https://git.kernel.org/stable/c/8ab24fdebc369c0dfb90f82c1650b1e66662bb45'
tags:
  - cve.org
epss: 0.00339
epssPercentile: 0.25768
ingestedAt: '2026-10-16T17:24:46.770Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mptcp: close TOCTOU race while computing rcv_wnd

The MPTCP output path access locklessly the MPTCP-level ack_seq
in multiple times, using possibly different values for the data_ack
in the DSS option and to compute the announced rcv wnd for the same
packet.

Refactor the cote to avoid inconsistencies which may confuse the
peer. Also ensure that the MPTCP level rcv wnd is updated only when
the egress packet actually contains a DSS ack.

## Affected

- `Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 < 301a33fd590c408a05c5df800e0cc1e6a8a2f8f8`
- `Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 < 68364963e5baf03f16b4420292291f75c8f66497`
- `Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 < 907ac6b1658e0277f979fcdfae2a753b495c1510`
- `Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 < c4f4cf60797974873dbc8e100144682a6f2f861f`
- `Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 < 3b8cbba7c0ed31189c89f90be247b8973ffa79ef`
- `Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 < 8f4f0a157e8436a05bf8c3670b24dbc258911c43`
- `Linux >= fa3fe2b150316b294f2c662653501273ff25bba8 < 8ab24fdebc369c0dfb90f82c1650b1e66662bb45`
- `Linux 5.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.