{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43029", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.976Z", "datePublished": "2026-05-01T14:15:29.885Z", "dateUpdated": "2026-08-05T12:25:22.854Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:22.854Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix soft lockup in mptcp_recvmsg()\n\nsyzbot reported a soft lockup in mptcp_recvmsg() [0].\n\nWhen receiving data with MSG_PEEK | MSG_WAITALL flags, the skb is not\nremoved from the sk_receive_queue. This causes sk_wait_data() to always\nfind available data and never perform actual waiting, leading to a soft\nlockup.\n\nFix this by adding a 'last' parameter to track the last peeked skb.\nThis allows sk_wait_data() to make informed waiting decisions and prevent\ninfinite loops when MSG_PEEK is used.\n\n[0]:\nwatchdog: BUG: soft lockup - CPU#2 stuck for 156s! [server:1963]\nModules linked in:\nCPU: 2 UID: 0 PID: 1963 Comm: server Not tainted 6.19.0-rc8 #61 PREEMPT(none)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:sk_wait_data+0x15/0x190\nCode: 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 49 89 f4 55 48 89 d5 53 48 89 fb <48> 83 ec 30 65 48 8b 05 17 a4 6b 01 48 89 44 24 28 31 c0 65 48 8b\nRSP: 0018:ffffc90000603ca0 EFLAGS: 00000246\nRAX: 0000000000000000 RBX: ffff888102bf0800 RCX: 0000000000000001\nRDX: 0000000000000000 RSI: ffffc90000603d18 RDI: ffff888102bf0800\nRBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000101\nR10: 0000000000000000 R11: 0000000000000075 R12: ffffc90000603d18\nR13: ffff888102bf0800 R14: ffff888102bf0800 R15: 0000000000000000\nFS: 00007f6e38b8c4c0(0000) GS:ffff8881b877e000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055aa7bff1680 CR3: 0000000105cbe000 CR4: 00000000000006f0\nCall Trace:\n \n mptcp_recvmsg+0x547/0x8c0 net/mptcp/protocol.c:2329\n inet_recvmsg+0x11f/0x130 net/ipv4/af_inet.c:891\n sock_recvmsg+0x94/0xc0 net/socket.c:1100\n __sys_recvfrom+0xb2/0x130 net/socket.c:2256\n __x64_sys_recvfrom+0x1f/0x30 net/socket.c:2267\n do_syscall_64+0x59/0x2d0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:131\nRIP: 0033:0x7f6e386a4a1d\nCode: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 f1 de 2c 00 41 89 ca 8b 00 85 c0 75 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6b f3 c3 66 0f 1f 84 00 00 00 00 00 41 56 41\nRSP: 002b:00007ffc3c4bb078 EFLAGS: 00000246 ORIG_RAX: 000000000000002d\nRAX: ffffffffffffffda RBX: 000000000000861e RCX: 00007f6e386a4a1d\nRDX: 00000000000003ff RSI: 00007ffc3c4bb150 RDI: 0000000000000004\nRBP: 00007ffc3c4bb570 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000103 R11: 0000000000000246 R12: 00005605dbc00be0\nR13: 00007ffc3c4bb650 R14: 0000000000000000 R15: 0000000000000000\n " } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - MPTCP is a TCP-based network protocol, and in a reasonable network-facing MPTCP service using recv with MSG_PEEK|MSG_WAITALL, a remote peer can populate the receive queue and trigger the vulnerable receive path by sending insufficient data. The vulnerable function is reached through normal socket receive handling for MPTCP data.\nAC:L - No race, memory layout, or hard-to-control timing is required; once the target performs the blocking peek receive, the attacker controls whether the receive queue contains the same partial data that causes the loop. The condition is reliably repeatable.\nPR:N - A remote peer does not need local credentials or kernel capabilities to connect to an exposed MPTCP service and send data before authentication. MPTCP socket creation itself has no capability gate and is enabled by default when configured.\nUI:N - No human user action is required after the vulnerable service is running. The trigger is normal network traffic plus the service's receive call.\nS:U - The impact is a kernel availability failure on the same host/security authority. It does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug is an infinite receive/wait loop caused by MSG_PEEK retaining the skb on the receive queue. There is no memory corruption or information disclosure primitive.\nI:N - The fix and code path show no unauthorized write, data modification, or control-flow corruption. The observed failure is a soft lockup only.\nA:H - The bug causes sk_wait_data to return immediately forever, producing a kernel soft lockup with a CPU stuck for an extended period. Repeated connections could consume availability, so the availability impact is high." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/mptcp/protocol.c" ], "versions": [ { "version": "8e04ce45a8db7a080220e86e249198fa676b83dc", "lessThan": "58b58b9ba89c43914eea90c18928e51852d10c24", "status": "affected", "versionType": "git" }, { "version": "8e04ce45a8db7a080220e86e249198fa676b83dc", "lessThan": "de3c248d1b69eaefa2d5b3da4005936dcf590f1b", "status": "affected", "versionType": "git" }, { "version": "8e04ce45a8db7a080220e86e249198fa676b83dc", "lessThan": "5dd8025a49c268ab6b94d978532af3ad341132a7", "status": "affected", "versionType": "git" }, { "version": "49888b3b457b801282b44c246d289c56e2f2a55b", "status": "affected", "versionType": "git" }, { "version": "0206a9341e652167c610dcd79f3d4e9e8153984c", "status": "affected", "versionType": "git" }, { "version": "7d6d10eee01edc9c20850ea75cf8273dc1170921", "status": "affected", "versionType": "git" }, { "version": "6.6.117", "lessThan": "6.7", "status": "affected", "versionType": "semver" }, { "version": "6.12.59", "lessThan": "6.13", "status": "affected", "versionType": "semver" }, { "version": "6.17.8", "lessThan": "6.18", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/mptcp/protocol.c" ], "versions": [ { "version": "6.18", "status": "affected" }, { "version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.22" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.117" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.59" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/58b58b9ba89c43914eea90c18928e51852d10c24" }, { "url": "https://git.kernel.org/stable/c/de3c248d1b69eaefa2d5b3da4005936dcf590f1b" }, { "url": "https://git.kernel.org/stable/c/5dd8025a49c268ab6b94d978532af3ad341132a7" } ], "title": "mptcp: fix soft lockup in mptcp_recvmsg()", "x_generator": { "engine": "bippy-1.2.0" } } } }