Look up another CVE · open CVE-2026-53183 in the interactive tracker
CVE-2026-53183
mptcp: allow subflow rcv wnd to shrink
Published 2026-06-25 (4 months ago) by the Linux kernel CNA. Subsystem net/mptcp. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-53183 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4665-1 · 2026-07-03 · text | 6.1.176-1 | Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In MPTCP connection, the `window` field in the TCP header refers to the MPTCP-level rcv_nxt and it's right edge should not move backward. Such constraint is enforced at DSS option generation time. At the same time, the TCP stack ensures independently that the TCP-level rcv wnd right's edge does not move backward. That in turn causes artificial inflating of the MPTCP rcv window when the incoming data is acked at the TCP level and is OoO in the MPTCP sequence space (or lands in the backlog). As a consequence, the incoming traffic can exceed the receiver rcvbuf size even when the sender is not misbehaving. Prevent such scenario forcibly allowing the TCP subflow to shrink the TCP-level rcv wnd regardless of the current netns setting.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/mptcp/options.c
- What this is
- NETWORKING [MPTCP]MAINTAINERS section matched on net/mptcp/ · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_MPTCP /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_MPTCP
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-25 (4 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.49%, higher than 40.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/mptcp
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.19 | 6.1.176 | bf364b0f10b2 |
| 5.19 | 6.6.143 | b1fd13074f22 |
| 5.19 | 6.12.94 | aa3861f40ac3 |
| 5.19 | 6.18.36 | 653245266913 |
| 5.19 | 7.0.13 | c297a4e65c50 |
| 5.19 | 7.1 | da23be77e129 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4671-1 | 2026-07-05 | bullseye 6.1.176-1~deb11u1 | tracker |
| DLA-4665-1 | 2026-07-03 | bookworm 6.1.176-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable code is reachable through received TCP/MPTCP packets on an established MPTCP connection, including an internet-facing MPTCP-enabled service. The attacker can be a remote MPTCP peer sending crafted valid data patterns.
- AC:LAttack complexity, low
- A peer can intentionally send valid MPTCP data that is out of order in MPTCP sequence space, causing TCP-level ACK/window advancement while MPTCP receive space remains consumed. No race or condition outside the attacker's control is required.
- PR:NPrivileges required, none
- The kernel packet processing path has no privilege or authentication gate once the remote peer establishes an MPTCP connection. Application-level authentication is not required to reach the vulnerable TCP/MPTCP receive and ACK-generation code.
- UI:NUser interaction, none
- An attacker can target an MPTCP-enabled listener or service directly over the network. No victim user interaction is needed.
- S:UScope, unchanged
- The impact is within the same kernel/network stack security authority on the affected host. There is no VM escape, sandbox boundary crossing, or separate security scope involved.
- C:NConfidentiality impact, none
- The bug causes receive-window over-advertisement and excessive receive-buffer consumption, not an out-of-bounds access, use-after-free, or information disclosure primitive. I found no path to reading kernel or application data.
- I:NIntegrity impact, none
- The affected logic corrupts flow-control accounting rather than attacker-controlled memory or persistent state. I found no arbitrary write, data modification, or control-flow hijack primitive.
- A:HAvailability impact, high
- A remote peer can drive incoming MPTCP traffic beyond the intended receive-buffer limit, creating kernel socket-buffer memory pressure and denial of service against the host or service. Repeated unauthenticated network triggering makes high availability impact defensible.