CVE-2026-53183: Linux Kernel MPTCP Receive Window Vulnerability (DoS)

Technical summary

The vulnerability exists in how MPTCP manages receive window (rcv_wnd) constraints across subflows. While MPTCP-level flow control prevents the window's right edge from moving backward at the DSS (Data Sequence Signal) option generation stage, the underlying TCP stack independently enforces its own rcv_wnd constraint. When incoming data is acknowledged at the TCP level but arrives out-of-order in MPTCP sequence space or lands in the backlog, the TCP window artificially inflates, bypassing the intended MPTCP-level flow control. The fix allows TCP subflows to shrink their receive window regardless of netns (network namespace) settings, preventing this artificial window expansion and ensuring traffic stays within the receiver's configured buffer limits.

Business impact

A successful denial of service attack exploiting this flaw could disrupt services relying on MPTCP, particularly those handling high-bandwidth, out-of-order traffic patterns such as mobile applications, load-balanced connections, or cloud services using multipath delivery. The impact is compounded in environments where multiple TCP subflows reassemble into a single MPTCP connection—an attacker can flood one or more subflows to exhaust receiver buffers system-wide. Organizations running MPTCP-enabled kernels in production face potential service degradation or unavailability without remediation.

Affected systems

The vulnerability affects Linux kernel implementations with MPTCP support enabled. MPTCP is not enabled by default in all distributions, but it is increasingly common in mobile-first and cloud environments. Affected systems include Linux servers and devices configured with kernel versions that support MPTCP and have not yet applied the fix. Verify your kernel configuration to determine if CONFIG_MPTCP is enabled and check your kernel version against vendor advisories for patched releases.

Exploitability

Exploitation requires network access and the ability to send crafted packets to an MPTCP-enabled system. The CVSS score of 7.5 reflects a network-accessible vulnerability requiring no authentication or user interaction. However, the attacker must target a system with MPTCP enabled and an active MPTCP connection; systems not using MPTCP are unaffected. The attack is straightforward once conditions are met: sending out-of-order TCP segments on MPTCP subflows forces window inflation, enabling a denial of service. This is not yet listed on the KEV (Known Exploited Vulnerabilities) catalog, meaning active exploitation in the wild has not been publicly confirmed at the time of publication.

Remediation

Apply kernel patches that implement the fix allowing TCP subflows to shrink their receive window. Most major Linux distributions have released or will release patched kernel versions; consult your vendor's security advisory for specific patch versions and timelines. If patches are not immediately available, consider disabling MPTCP (set CONFIG_MPTCP=n at build time) in non-critical systems that do not require multipath connectivity, or isolate MPTCP-enabled systems from untrusted networks until patches are deployed.

Patch guidance

Obtain and install the latest kernel update from your Linux distribution vendor that includes the MPTCP rcv_wnd fix. For distributions with long-term support (LTS) kernels, expect backported fixes to stable branches. Verify the kernel version or commit hash against your vendor's advisory before and after patching. Reboot systems post-patch to ensure the updated kernel is running. If your organization maintains custom kernel builds, apply the upstream fix and rebuild your kernel image. Test patches in a non-production environment first, particularly if MPTCP is critical to your workload.

Detection guidance

Monitor system logs for evidence of receive buffer exhaustion or out-of-memory conditions on systems using MPTCP. Network intrusion detection systems (IDS) should look for patterns of out-of-order TCP segments arriving on multiple subflows of the same connection. Check kernel metrics via /proc/net/mptcp or similar interfaces for signs of window shrinkage failures or subflow anomalies. Use netstat or ss to enumerate active MPTCP connections and their state. In high-traffic environments, correlate buffer exhaustion events with specific client IP addresses or connection patterns to identify potential attack sources. Forensic analysis should focus on packet captures showing interleaved out-of-order segments across subflows.

Why prioritize this

Despite a HIGH CVSS score (7.5) and straightforward network-based exploitability, this vulnerability's real-world impact is somewhat constrained: MPTCP must be enabled, an active MPTCP connection must exist, and the attacker must have network access. However, organizations deploying MPTCP for mobile clients, multi-carrier failover, or cloud load balancing should prioritize patching because the denial-of-service impact is severe and easily triggered. The lack of KEV designation does not diminish the urgency for affected deployments; patching should occur within your standard critical update cycle. Tier your response: patch production systems using MPTCP immediately; systems without MPTCP can follow routine patch schedules.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is justified by the network-accessible attack vector, lack of authentication or user interaction requirements, and high availability impact. The score appropriately reflects the denial-of-service severity. However, context matters: the actual risk to your organization depends on whether MPTCP is deployed, whether systems are exposed to untrusted networks, and how critical MPTCP-dependent services are to your operations. A system without MPTCP enabled has zero risk; a heavily trafficked MPTCP gateway has maximum risk. Use this score as a starting point and adjust your internal prioritization based on asset criticality and exposure.

Frequently asked questions