CVE-2026-43029— mptcp: fix soft lockup in mptcp_recvmsg()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mptcp中mptcp_recvmsg函数使用MSG_PEEK时未跟踪上次窥探的skb，可能导致软锁。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1499 · Endpoint Denial of ServiceAffected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 8e04ce45a8db7a080220e86e249198fa676b83dc< 58b58b9ba89c43914eea90c18928e51852d10c24 |
affected |
8e04ce45a8db7a080220e86e249198fa676b83dc< de3c248d1b69eaefa2d5b3da4005936dcf590f1b |
affected | ||
8e04ce45a8db7a080220e86e249198fa676b83dc< 5dd8025a49c268ab6b94d978532af3ad341132a7 |
affected | ||
49888b3b457b801282b44c246d289c56e2f2a55b |
affected | ||
0206a9341e652167c610dcd79f3d4e9e8153984c |
affected | ||
7d6d10eee01edc9c20850ea75cf8273dc1170921 |
affected | ||
6.6.117< 6.7 |
affected | ||
6.12.59< 6.13 |
affected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-43029
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mptcp: fix soft lockup in mptcp_recvmsg()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix soft lockup in mptcp_recvmsg()
syzbot reported a soft lockup in mptcp_recvmsg() [0].
When receiving data with MSG_PEEK | MSG_WAITALL flags, the skb is not
removed from the sk_receive_queue. This causes sk_wait_data() to always
find available data and never perform actual waiting, leading to a soft
lockup.
Fix this by adding a 'last' parameter to track the last peeked skb.
This allows sk_wait_data() to make informed waiting decisions and prevent
infinite loops when MSG_PEEK is used.
[0]:
watchdog: BUG: soft lockup - CPU#2 stuck for 156s! [server:1963]
Modules linked in:
CPU: 2 UID: 0 PID: 1963 Comm: server Not tainted 6.19.0-rc8 #61 PREEMPT(none)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:sk_wait_data+0x15/0x190
Code: 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 49 89 f4 55 48 89 d5 53 48 89 fb <48> 83 ec 30 65 48 8b 05 17 a4 6b 01 48 89 44 24 28 31 c0 65 48 8b
RSP: 0018:ffffc90000603ca0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888102bf0800 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffc90000603d18 RDI: ffff888102bf0800
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000101
R10: 0000000000000000 R11: 0000000000000075 R12: ffffc90000603d18
R13: ffff888102bf0800 R14: ffff888102bf0800 R15: 0000000000000000
FS: 00007f6e38b8c4c0(0000) GS:ffff8881b877e000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055aa7bff1680 CR3: 0000000105cbe000 CR4: 00000000000006f0
Call Trace:
<TASK>
mptcp_recvmsg+0x547/0x8c0 net/mptcp/protocol.c:2329
inet_recvmsg+0x11f/0x130 net/ipv4/af_inet.c:891
sock_recvmsg+0x94/0xc0 net/socket.c:1100
__sys_recvfrom+0xb2/0x130 net/socket.c:2256
__x64_sys_recvfrom+0x1f/0x30 net/socket.c:2267
do_syscall_64+0x59/0x2d0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:131
RIP: 0033:0x7f6e386a4a1d
Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 f1 de 2c 00 41 89 ca 8b 00 85 c0 75 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6b f3 c3 66 0f 1f 84 00 00 00 00 00 41 56 41
RSP: 002b:00007ffc3c4bb078 EFLAGS: 00000246 ORIG_RAX: 000000000000002d
RAX: ffffffffffffffda RBX: 000000000000861e RCX: 00007f6e386a4a1d
RDX: 00000000000003ff RSI: 00007ffc3c4bb150 RDI: 0000000000000004
RBP: 00007ffc3c4bb570 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000103 R11: 0000000000000246 R12: 00005605dbc00be0
R13: 00007ffc3c4bb650 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mptcp中mptcp_recvmsg函数使用MSG_PEEK时未跟踪上次窥探的skb，可能导致软锁。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-43029
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-43029
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-43029 (3)
Same Patch Batch · Linux · 2026-05-01 · 146 CVEs total
| CVE-2026-43011 | 9.8 CRITICAL | net/x25: Fix potential double free of skb |
| CVE-2026-43037 | 9.8 CRITICAL | ip6_tunnel: clear skb2->cb[] in ip4ip6_err() |
| CVE-2026-31705 | 9.8 CRITICAL | ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment |
| CVE-2026-43038 | 9.8 CRITICAL | ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() |
| CVE-2026-43039 | 9.8 CRITICAL | net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch |
| CVE-2026-31718 | 9.8 CRITICAL | ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger |
| CVE-2026-43018 | 8.8 HIGH | Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt |
| CVE-2026-31773 | 8.8 HIGH | Bluetooth: SMP: derive legacy responder STK authentication from MITM state |
| CVE-2026-31739 | 8.8 HIGH | crypto: tegra - Add missing CRYPTO_ALG_ASYNC |
| CVE-2026-31735 | 8.8 HIGH | iommupt: Fix short gather if the unmap goes into a large mapping |
| CVE-2026-31717 | 8.8 HIGH | ksmbd: validate owner of durable handle on reconnect |
| CVE-2026-43048 | 8.8 HIGH | HID: core: Mitigate potential OOB by removing bogus memset() |
| CVE-2026-31709 | 8.8 HIGH | smb: client: validate the whole DACL before rewriting it in cifsacl |
| CVE-2026-31706 | 8.8 HIGH | ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() |
| CVE-2026-31712 | 8.3 HIGH | ksmbd: require minimum ACE size in smb_check_perm_dacl() |
| CVE-2026-31771 | 8.1 HIGH | Bluetooth: hci_event: move wake reason storage into validated event handlers |
| CVE-2026-31779 | 8.1 HIGH | wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() |
| CVE-2026-43051 | 8.1 HIGH | HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq |
| CVE-2026-31708 | 8.1 HIGH | smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path |
| CVE-2026-31695 | 7.8 HIGH | wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free |
Showing top 20 of 146 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2026-43029
No comments yet