What is CVE-2026-63867?

CVE-2026-63867 is a high-severity vulnerability in Linux. CVSS score: 8.2/10. Published 2026-07-19.

How severe is CVE-2026-63867?

High severity. CVSS v3 base score is 8.2 out of 10.

Vulnerability in Linux

CVE-2026-63867

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack.

EPSS: 0.006 (46.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H.

Affected products

Linux — versions fa3fe2b150316b294f2c662653501273ff25bba8, 5.11, 0

References

Frequently asked questions

What is CVE-2026-63867?: CVE-2026-63867 is a high-severity vulnerability in Linux. CVSS score: 8.2/10. Published 2026-07-19.
How severe is CVE-2026-63867?: High severity. CVSS v3 base score is 8.2 out of 10.