In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access… (CVE-2026-63867)
In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.
AI Analysis
Technical Summary
CVE-2026-63867 addresses a TOCTOU race condition in the Linux kernel's MPTCP output path. The vulnerability arises from multiple lockless accesses to the MPTCP-level ack_seq, which may use different data_ack values from the DSS option to compute the announced receive window for the same packet. This inconsistency could lead to confusing the peer about the receive window state. The patch refactors the code to prevent these inconsistencies and updates the receive window only when the egress packet actually contains a DSS acknowledgment.
Potential Impact
The vulnerability could cause inconsistent receive window announcements in MPTCP connections, potentially leading to communication issues or protocol confusion between peers. There is no indication of direct exploitation or broader impact such as privilege escalation or denial of service.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Since no affected versions or patch links are provided, users should consult the official Linux kernel advisories or update to the latest kernel versions where this issue is resolved. No additional mitigation steps are indicated.
In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access… (CVE-2026-63867)
Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.
CVSS v3.1
Score 8.2high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-63867 addresses a TOCTOU race condition in the Linux kernel's MPTCP output path. The vulnerability arises from multiple lockless accesses to the MPTCP-level ack_seq, which may use different data_ack values from the DSS option to compute the announced receive window for the same packet. This inconsistency could lead to confusing the peer about the receive window state. The patch refactors the code to prevent these inconsistencies and updates the receive window only when the egress packet actually contains a DSS acknowledgment.
Potential Impact
The vulnerability could cause inconsistent receive window announcements in MPTCP connections, potentially leading to communication issues or protocol confusion between peers. There is no indication of direct exploitation or broader impact such as privilege escalation or denial of service.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Since no affected versions or patch links are provided, users should consult the official Linux kernel advisories or update to the latest kernel versions where this issue is resolved. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wqpm-3qh2-7cxj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63867"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27ac2a4a8d59891302fc
Added to database: 07/19/2026, 19:38:20 UTC
Last enriched: 07/19/2026, 20:13:38 UTC
Last updated: 08/26/2026, 22:52:12 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.