Linux Kernel MPTCP Cleans Up Subflow backlog References Outside the Lock That Guards the Backlog List, Leaving a Stale skb->sk Pointer After Subflow Close

Status: NEW  |  Advisory ID: CVE-2026-68170

Key Details

What to Know

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix stale skb->sk reference on subflow close

The backlog list is updated by mptcp_data_ready() under

mptcp_data_lock(). The cleanup of backlog references to a closing

subflow, however, was performed in mptcp_close_ssk(), before

__mptcp_close_ssk() acquires the ssk lock, and while holding neither

the ssk lock nor mptcp_data_lock().

Because that traversal ran without mptcp_data_lock(), concurrent softirq

RX processing on another CPU (subflow_data_ready() -> mptcp_data_ready()

-> __mptcp_add_backlog(), under mptcp_data_lock()) could add a backlog

entry referencing the ssk while the cleanup loop was in progress. Such

an entry could be missed by the cleanup, or the concurrent list update

could corrupt the traversal, leaving skb->sk pointing at the ssk after

it is freed.

A later mptcp_backlog_purge() then dereferences the stale pointer,

triggering a warning in inet_sock_destruct() (ssk->sk_rmem_alloc != 0)

followed by a use-after-free in mptcp_backlog_purge().

Fix this by moving the backlog cleanup into __mptcp_close_ssk(), after

subflow->closing is set to 1 and while the ssk lock is still held,

serialized under mptcp_data_lock(). The cleanup runs only on the push

path (MPTCP_CF_PUSH), where backlog references accumulate; on other

teardown paths the caller already handles cleanup.

With subflow->closing set and mptcp_data_lock() held across the purge,

any concurrent mptcp_data_ready() either completes its enqueue before

the purge runs and is caught, or observes closing=1 and bails out. Once

mptcp_data_unlock() is reached, no new skb referencing the ssk can be

enqueued, so the cleanup is exhaustive.

Remove the unprotected traversal from mptcp_close_ssk() entirely. (NVD)

References