CVE-2026-31669

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side critical sections. Both tcp_prot and tcpv6_prot have their slab caches created with this flag via proto_register(). However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override during inet_init() (fs_initcall, level 5), before inet6_init() (module_init/device_initcall, level 6) has called proto_register(&tcpv6_prot). At...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= b19bc2945b40b9fd38e835700907ffe8534ef0de < f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47, >= b19bc2945b40b9fd38e835700907ffe8534ef0de < fb1f54b7d16f393b8b65d328410f78b4beea8fcc, >= b19bc2945b40b9fd38e835700907ffe8534ef0de < 3fd6547f5b8ac99687be6d937a0321efda760597, >= b19bc2945b40b9fd38e835700907ffe8534ef0de < eb9c6aeb512f877cf397deb1e4526f646c70e4a7, >= b19bc2945b40b9fd38e835700907ffe8534ef0de < 15fa9ead4d5e6b6b9c794e84144146c917f2cb62, >= b19bc2945b40b9fd38e835700907ffe8534ef0de < b313e9037d98c13938740e5ebda7852929366dff, >= b19bc2945b40b9fd38e835700907ffe8534ef0de < 9b55b253907e7431210483519c5ad711a37dafa1, >= 5.12, >= V3.1.6, >= V3.1.5, >= 5.12.1 < 5.15.203, >= 5.16 < 6.1.169, >= 6.2 < 6.6.135, >= 6.7 < 6.12.82, >= 6.13 < 6.18.23, >= 6.19 < 6.19.13, 5.12, 7.0

Fixed versions

5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416