CVE-2026-68170: mptcp: fix stale skb->sk reference on subflow close

Q: What is the severity of CVE-2026-68170?

CVE-2026-68170 has a risk score of 57.

Q: What type of vulnerability is CVE-2026-68170?

CVE-2026-68170 is classified as a Use After Free vulnerability.

Q: How does CVE-2026-68170 affect the Linux kernel?

CVE-2026-68170 causes a stale skb->sk reference during subflow closure in the Linux kernel.

Published Aug 10, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix stale skb->sk reference on subflow close

The backlog list is updated by mptcpdataready() under mptcpdatalock(). The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk(), before mptcpclosessk() acquires the ssk lock, and while holding neither the ssk lock nor mptcpdatalock().

Because that traversal ran without mptcpdatalock(), concurrent softirq RX processing on another CPU (subflowdataready() -> mptcpdataready() -> mptcpaddbacklog(), under mptcpdatalock()) could add a backlog entry referencing the ssk while the cleanup loop was in progress. Such an entry could be missed by the cleanup, or the concurrent list update could corrupt the traversal, leaving skb->sk pointing at the ssk after it is freed.

A later mptcpbacklogpurge() then dereferences the stale pointer, triggering a warning in inetsockdestruct() (ssk->skrmemalloc != 0) followed by a use-after-free in mptcpbacklogpurge().

Fix this by moving the backlog cleanup into mptcpclosessk(), after subflow->closing is set to 1 and while the ssk lock is still held, serialized under mptcpdatalock(). The cleanup runs only on the push path (MPTCPCFPUSH), where backlog references accumulate; on other teardown paths the caller already handles cleanup.

With subflow->closing set and mptcpdatalock() held across the purge, any concurrent mptcpdataready() either completes its enqueue before the purge runs and is caught, or observes closing=1 and bails out. Once mptcpdataunlock() is reached, no new skb referencing the ssk can be enqueued, so the cleanup is exhaustive.

Remove the unprotected traversal from mptcpclosessk() entirely.

Affected Software

125 affected componentsFixes available

Linux Linux kernel

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1

7.0.0-1017.17~24.04.1

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1

7.0.0-1016.16~24.04.1

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-7.0<7.0.0-38.38~24.04.4

7.0.0-38.38~24.04.4

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-7.0<7.0.0-1024.25~24.04.1

7.0.0-1024.25~24.04.1

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-38.38.1~24.04.1

7.0.0-38.38.1~24.04.1

ubuntu/linux-realtime-6.14*

ubuntu/linux<7.0.0-38.38

7.0.0-38.38

ubuntu/linux-aws<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-azure<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-azure-fde<7.0.0-1016.16

7.0.0-1016.16

ubuntu/linux-gcp<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-gke<7.0.0-1008.9

7.0.0-1008.9

ubuntu/linux-ibm<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos<7.0.0-2022.23

7.0.0-2022.23

ubuntu/linux-oem-7.0<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-oracle<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-raspi*

ubuntu/linux-realtime<7.0.0-38.38.1

7.0.0-38.38.1

ubuntu/linux-riscv<7.0.0-38.38.1

7.0.0-38.38.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38~24.04.4
Upgrade
Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1024.25~24.04.1
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.9
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.
Fixed in 7.0.0-2022.23
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1

Event History

Aug 10, 2026

CVE Published

via MITRE·11:59 AM

Data Sourced

via MITRE·11:59 AM

DescriptionSeverity

Data Sourced

via OSV·01:20 PM

DescriptionSeverityAffected Software

Event

via OSV·01:20 PM

Data Sourced

via NVD·01:20 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2026-68170?

CVE-2026-68170 has a risk score of 57.

What type of vulnerability is CVE-2026-68170?

CVE-2026-68170 is classified as a Use After Free vulnerability.

How does CVE-2026-68170 affect the Linux kernel?

CVE-2026-68170 causes a stale skb->sk reference during subflow closure in the Linux kernel.

How do I fix CVE-2026-68170?

To fix CVE-2026-68170, update your Linux kernel to the latest available version that addresses this vulnerability.

When was CVE-2026-68170 published?

CVE-2026-68170 was published on August 10, 2026.

CVE-2026-68170: mptcp: fix stale skb->sk reference on subflow close

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2026-68170?

What type of vulnerability is CVE-2026-68170?

How does CVE-2026-68170 affect the Linux kernel?

How do I fix CVE-2026-68170?

When was CVE-2026-68170 published?

Company

Resources

Contact