In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access… (CVE-2026-63867)
A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation has been resolved. The issue involved lockless multiple accesses to the MPTCP-level ack_seq, potentially using inconsistent data_ack values in the DSS option and computing the receive window (rcv_wnd) incorrectly for the same packet. This could cause inconsistencies that may confuse the peer. The fix refactors the code to avoid these inconsistencies and ensures the receive window is updated only when the egress packet contains a DSS acknowledgment.
AI Analysis
Technical Summary
CVE-2026-63867 addresses a TOCTOU race condition in the Linux kernel's MPTCP output path. The vulnerability arises from multiple lockless accesses to the MPTCP-level ack_seq, which may use different data_ack values from the DSS option to compute the announced receive window for the same packet. This inconsistency could lead to confusing the peer about the receive window state. The patch refactors the code to prevent these inconsistencies and updates the receive window only when the egress packet actually contains a DSS acknowledgment.
Potential Impact
The vulnerability could cause inconsistent receive window announcements in MPTCP connections, potentially leading to communication issues or protocol confusion between peers. There is no indication of direct exploitation or broader impact such as privilege escalation or denial of service.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Since no affected versions or patch links are provided, users should consult the official Linux kernel advisories or update to the latest kernel versions where this issue is resolved. No additional mitigation steps are indicated.
In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access… (CVE-2026-63867)
Description
A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation has been resolved. The issue involved lockless multiple accesses to the MPTCP-level ack_seq, potentially using inconsistent data_ack values in the DSS option and computing the receive window (rcv_wnd) incorrectly for the same packet. This could cause inconsistencies that may confuse the peer. The fix refactors the code to avoid these inconsistencies and ensures the receive window is updated only when the egress packet contains a DSS acknowledgment.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-63867 addresses a TOCTOU race condition in the Linux kernel's MPTCP output path. The vulnerability arises from multiple lockless accesses to the MPTCP-level ack_seq, which may use different data_ack values from the DSS option to compute the announced receive window for the same packet. This inconsistency could lead to confusing the peer about the receive window state. The patch refactors the code to prevent these inconsistencies and updates the receive window only when the egress packet actually contains a DSS acknowledgment.
Potential Impact
The vulnerability could cause inconsistent receive window announcements in MPTCP connections, potentially leading to communication issues or protocol confusion between peers. There is no indication of direct exploitation or broader impact such as privilege escalation or denial of service.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Since no affected versions or patch links are provided, users should consult the official Linux kernel advisories or update to the latest kernel versions where this issue is resolved. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wqpm-3qh2-7cxj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63867"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27ac2a4a8d59891302fc
Added to database: 07/19/2026, 19:38:20 UTC
Last enriched: 07/19/2026, 20:13:38 UTC
Last updated: 07/20/2026, 17:26:47 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.