CVE-2026-31669: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31669 is a slab-use-after-free vulnerability in the Linux kernel's MPTCP (Multipath TCP) implementation affecting IPv6 subflow initialization. The flaw causes MPTCP v6 subflow child sockets to be allocated via kmalloc instead of the TCPv6 slab cache, enabling concurrent ehash table lookups to access freed memory. It was published on April 24, 2026, and affects Linux kernel versions from 5.12 through 7.0-rc7 across multiple stable branches. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-416: Use After Free; CWE-763: Release of Invalid Pointer or Reference) lies in a kernel initialization ordering issue: mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override during inet_init() (fs_initcall, level 5), before inet6_init() (level 6) has called proto_register(&tcpv6_prot). At copy time, tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab remains NULL permanently. As a result, MPTCP v6 child sockets land in the kmalloc-4k cache, which lacks SLAB_TYPESAFE_BY_RCU; when these sockets are freed (without SOCK_RCU_FREE, which is cleared for child sockets by design), their memory can be immediately reused. Concurrent lockless ehash lookups under rcu_read_lock can then dereference the freed memory, triggering a slab-use-after-free in __inet_lookup_established. The fix splits IPv6-specific initialization into a new mptcp_subflow_v6_init() function called from mptcp_proto_v6_init() before protocol registration, ensuring tcpv6_prot_override.slab correctly inherits the SLAB_TYPESAFE_BY_RCU slab cache (GitHub Advisory).

Successful exploitation can result in denial of service via kernel panics, information disclosure by reading freed memory contents, and potential privilege escalation on affected systems. The vulnerability is network-accessible and requires no authentication or user interaction, making it reachable by any remote attacker on systems with MPTCP and IPv6 enabled. The memory corruption affects kernel-level socket structures, meaning exploitation could compromise the entire host and enable lateral movement within a network (GitHub Advisory, Red Hat Bugzilla).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.03%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection plugins are available from Nessus (e.g., plugin 310471, 318240, 319659) and Qualys, indicating active scanner coverage (Tenable).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing BUG: KASAN: slab-use-after-free or use-after-free errors referencing __inet_lookup_established or MPTCP/TCPv6 socket structures.
• Logs: Kernel oops or panic messages involving mptcp_subflow, tcpv6_prot_override, or kmalloc-4k slab cache corruption.
• Process: Unexpected kernel crashes or system reboots on hosts with MPTCP and IPv6 enabled, particularly under high concurrent connection load.
• Network: Anomalous TCP/MPTCP connection patterns targeting IPv6 endpoints, especially with high connection establishment rates that could trigger race conditions in ehash lookups.

Apply kernel updates to the following fixed versions: 5.15.203 (for 5.12.1–5.15.202), 6.1.169 (for 5.16–6.1.168), 6.6.135 (for 6.2–6.6.134), 6.12.82 (for 6.7–6.12.81), 6.18.23 (for 6.13–6.18.22), 6.19.13 (for 6.19–6.19.12), and 7.0 final (for 7.0-rc1–rc7). Stable kernel patches are available at git.kernel.org. For systems unable to patch immediately, disable MPTCP via sysctl -w net.mptcp.enabled=0 if MPTCP is not required, restrict IPv6 connectivity where feasible, and implement network segmentation to limit exposure. Amazon Linux 2 users should apply ALAS2KERNEL-5.15-2026-102; SUSE users should apply the relevant SUSE-SU advisories (GitHub Advisory, Amazon Linux Advisory, SUSE Advisory).

SUSE issued multiple security update announcements (SUSE-SU-20262111-1, SUSE-SU-20262195-1, SUSE-SU-20262215-1, SUSE-SU-20262238-1) addressing this vulnerability across their kernel packages (SUSE Advisory). Amazon Linux also released a kernel advisory (ALAS2KERNEL-5.15-2026-102) (Amazon Linux Advisory). Tenable published multiple Nessus detection plugins and pipeline issue trackers for this CVE. Community coverage has been limited, with brief mentions on Mastodon and aggregator sites, reflecting the technical nature of the kernel-level flaw.