{"schema":"threatline.record/2","record":{"id":"CVE-2026-97568","aliases":[],"summary":"mptcp: syncookies: remember the request backup flag","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: syncookies: remember the request backup flag\n\nInstead of using an uninitialised bit when copying the info in\nsubflow_ulp_clone().\n\nTo fix this, no need to extend the join_entry structure: backup is\ncoming from struct mptcp_subflow_request_sock, only one bit. Do the same\nhere by using one bit for both.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"1008f2bcbc8e461c1df3aebba30ac4f616ebe570","lessThan":"c97fa2c7ada82d4cac1c6c00643238dc4c462f15","status":"affected","versionType":"git"},{"version":"6f01f41b6a492ddf2da7609967cfaf57e7ca48a7","lessThan":"1668b34452009d27be3262646de748a3e48ffd51","status":"affected","versionType":"git"},{"version":"09176f80995105c62939728fbad5c437d61e7ff4","lessThan":"b138e7dc719f0a3949de8bb6500b8cf1604eea06","status":"affected","versionType":"git"},{"version":"8ed3e34c766e8264d5d2e0436f86c51604d6a8a7","lessThan":"360d99258a6402cb8e49771460944f19f04d25b7","status":"affected","versionType":"git"},{"version":"efd340bf3d7779a3a8ec954d8ec0fb8a10f24982","lessThan":"61178d0b85b4b1b53e78b06e89d018d22d102f88","status":"affected","versionType":"git"},{"version":"efd340bf3d7779a3a8ec954d8ec0fb8a10f24982","lessThan":"00b2bd518911e0daab00f4749cce68c191ccebb4","status":"affected","versionType":"git"},{"version":"efd340bf3d7779a3a8ec954d8ec0fb8a10f24982","lessThan":"06d649f9cd03a9f8e768a658b20acf8d2c8022e0","status":"affected","versionType":"git"},{"version":"efd340bf3d7779a3a8ec954d8ec0fb8a10f24982","lessThan":"b76c0e28b392620dfbaf92cdeedbf115820b44cb","status":"affected","versionType":"git"},{"version":"73e2baa301ee3f62ff971e68877adeb37f98cc67","status":"affected","versionType":"git"},{"version":"5.10.224","lessThan":"5.10.271","status":"affected","versionType":"semver"},{"version":"5.15.165","lessThan":"5.15.222","status":"affected","versionType":"semver"},{"version":"6.1.104","lessThan":"6.1.189","status":"affected","versionType":"semver"},{"version":"6.6.45","lessThan":"6.6.158","status":"affected","versionType":"semver"},{"version":"6.10.4","lessThan":"6.11","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"1668b34452009d27be3262646de748a3e48ffd51","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"360d99258a6402cb8e49771460944f19f04d25b7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"61178d0b85b4b1b53e78b06e89d018d22d102f88","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"00b2bd518911e0daab00f4749cce68c191ccebb4","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"06d649f9cd03a9f8e768a658b20acf8d2c8022e0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"5.10.271","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"5.15.222","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6.1.189","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6.6.158","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","source_modified_at":"2026-10-19T09:09:31.044Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6.11","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.0021,"percentile":0.10721,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:21:54.269Z","modified_at":"2026-10-19T09:09:31.044Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97568","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:09:31.044Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97568","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/c97fa2c7ada82d4cac1c6c00643238dc4c462f15"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/1668b34452009d27be3262646de748a3e48ffd51"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/b138e7dc719f0a3949de8bb6500b8cf1604eea06"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/360d99258a6402cb8e49771460944f19f04d25b7"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/61178d0b85b4b1b53e78b06e89d018d22d102f88"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/00b2bd518911e0daab00f4749cce68c191ccebb4"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/06d649f9cd03a9f8e768a658b20acf8d2c8022e0"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/b76c0e28b392620dfbaf92cdeedbf115820b44cb"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:09:31.044Z","content_hash":"5838f17cecf47411a1325c8a5fc1c93e45819c7dfa3b22107e25ad4cea208419"}}