01 Record

CVE-2026-63867

mptcp: close TOCTOU race while computing rcv_wnd

HighPUBLISHEDCNA: Linux

CNA base score8.2 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

View raw JSON

02 Description

mptcp: close TOCTOU race while computing rcv_wnd

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.27% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 19.5% of scored records. A rank, not a probability.

NVD base score

8.2 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

NVD analysis status

Analyzed. NVD last modified this record on 2026-10-26.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-19 14:18Z3 MO AGO

Last updated

2026-10-19 20:17Z10 DAYS AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.2)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')Class
CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionBase

Data version

5.2

Document digest

22cfe730153fd5a9969064fa9c87baacadd383f2b710361ec3cfa410b0b928b0

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxfa3fe2b150316b294f2c662653501273ff25bba8 to < 301a33fd590c408a05c5df800e0cc1e6a8a2f8f8, fa3fe2b150316b294f2c662653501273ff25bba8 to < 68364963e5baf03f16b4420292291f75c8f66497, fa3fe2b150316b294f2c662653501273ff25bba8 to < 907ac6b1658e0277f979fcdfae2a753b495c1510, fa3fe2b150316b294f2c662653501273ff25bba8 to < c4f4cf60797974873dbc8e100144682a6f2f861f, fa3fe2b150316b294f2c662653501273ff25bba8 to < 3b8cbba7c0ed31189c89f90be247b8973ffa79ef, fa3fe2b150316b294f2c662653501273ff25bba8 to < 8f4f0a157e8436a05bf8c3670b24dbc258911c43, fa3fe2b150316b294f2c662653501273ff25bba8 to < 8ab24fdebc369c0dfb90f82c1650b1e66662bb45, 5.11—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/301a33fd590c408a05c5df800e0cc1e6a8a2f8f8
git.kernel.orghttps://git.kernel.org/stable/c/68364963e5baf03f16b4420292291f75c8f66497
git.kernel.orghttps://git.kernel.org/stable/c/907ac6b1658e0277f979fcdfae2a753b495c1510
git.kernel.orghttps://git.kernel.org/stable/c/c4f4cf60797974873dbc8e100144682a6f2f861f
git.kernel.orghttps://git.kernel.org/stable/c/3b8cbba7c0ed31189c89f90be247b8973ffa79ef
git.kernel.orghttps://git.kernel.org/stable/c/8f4f0a157e8436a05bf8c3670b24dbc258911c43
git.kernel.orghttps://git.kernel.org/stable/c/8ab24fdebc369c0dfb90f82c1650b1e66662bb45

07 Fixed in

Debian 12

linux
Fixed in 6.1.176-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.94-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.0.13-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.