Linux kernel MPTCP slab use-after-free in __inet_lookup_established
CVE-2026-31669 is a Linux kernel memory-safety vulnerability in MPTCP affecting IPv6 subflow child socket handling. The bug arises because mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override during inet_init(), before inet6_init() has registered tcpv6_prot via proto_register(). At that point tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab remains NULL permanently. As a result, MPTCP IPv6 subflow child sockets are allocated from the generic kmalloc-4k cache instead of the TCPv6 protocol slab cache. Linux ehash established-socket lookups in __inet_lookup_established are lockless and depend on socket allocations coming from a SLAB_TYPESAFE_BY_RCU slab to preserve object memory stability during RCU read-side critical sections. Because kmalloc-4k does not provide SLAB_TYPESAFE_BY_RCU, and child sockets are freed without SOCK_RCU_FREE by design, concurrent ehash lookups under rcu_read_lock can dereference memory that has already been freed and potentially reused, leading to a slab use-after-free in __inet_lookup_established. The fix splits IPv6-specific setup into mptcp_subflow_v6_init(), invoked from mptcp_proto_v6_init() before protocol registration, ensuring tcpv6_prot_override.slab inherits the correct SLAB_TYPESAFE_BY_RCU-backed slab cache.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
9 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.