CVE-2026-46137 was published by NVD on May 28, 2026, for a Linux kernel Multipath TCP path-manager race in the ADD_ADDR retransmission timer, fixed upstream by taking the socket lock in softirq context and retrying shortly when user context owns the socket. The terse advisory makes it look like...
CVE-2026-31669 is a newly published Linux kernel vulnerability that exposes how a small initialization-order mistake can undermine one of the kernel networking stack’s most delicate memory-safety assumptions. The flaw sits in Multipath TCP, specifically the IPv6 subflow path, where child sockets...
A subtle correctness bug in the Linux kernel's Multipath TCP (MPTCP) path‑manager was fixed this year after selftests and syzbot triggered a counter underflow and related warnings that can lead to sustained availability loss for hosts that use MPTCP — tracked as CVE‑2024‑45010 and fixed in the...