🛡️ CVE-2026-31669 — kernel

mptcp: fix slab-use-after-free in __inet_lookup_established

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix slab-use-after-free in __inet_lookup_established

The ehash table lookups are lockless and rely on

SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability

during RCU read-side critical sections. Both tcp_prot and

tcpv6_prot have their slab caches created with this flag

via proto_register().

However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into

tcpv6_prot_override during inet_init() (fs_initcall, level 5),

before inet6_init() (module_init/device_initcall, level 6) has

called proto_register(&tcpv6_prot). At that point,

tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab

remains NULL permanently.

This causes MPTCP v6 subflow child sockets to be allocated via

kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab

cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so

when these sockets are freed without SOCK_RCU_FREE (which is

cleared for child sockets by design), the memory can be

immediately reused. Concurrent ehash lookups under

rcu_read_lock can then access freed memory, triggering a

slab-use-after-free in __inet_lookup_established.

Fix this by splitting the IPv6-specific initialization out of

mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called

from mptcp_proto_v6_init() before protocol registration. This

ensures tcpv6_prot_override.slab correctly inherits the

SLAB_TYPESAFE_BY_RCU slab cache.