All vulnerabilities
CVE-2026-97524

Linux: mptcp: avoid unneeded actions on subflow reset

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.69%Chance of exploitation activity in the next 30 days, higher than 52% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6d669c740933124eae3df8cfc15995af9bcc6abaAlso 83a7dcdd2b1060484528da70a643125174d47e5a, 1962841387087970d75ba8b8d4c2aa2d45705e50 and 7 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 6d669c740933124eae3df8cfc15995af9bcc6abaLinuxCVE List
  • 83a7dcdd2b1060484528da70a643125174d47e5aLinuxCVE List
  • 1962841387087970d75ba8b8d4c2aa2d45705e50LinuxCVE List
  • 4b7abdcb5ba832fafab679f0d998af39cbc99307LinuxCVE List
  • 2b0f561f21b27c40c91ea4975268a06092bd7e9cLinuxCVE List
  • 5.10.271LinuxCVE List
Show all 10 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: avoid unneeded actions on subflow reset

Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again.

Break the recursion loop explicitly checking for the exceptional condition.

Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time.

This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling.

Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it.

Text from CVE List

Affected versions 24

  • Linuxaffected: fde99e972b8f88cebe619241d7aa43d288ef666a before 6d669c740933124eae3df8cfc15995af9bcc6abaCVE List
  • Linuxaffected: 12c1676d598e3b8dd92a033b623b792cc2ea1ec5 before 83a7dcdd2b1060484528da70a643125174d47e5aCVE List
  • Linuxaffected: 35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25 before a370e56024df0b07e3120c45a9773ae123819fd6CVE List
  • Linuxaffected: b8be15d1ae7ea4eedd547c3b3141f592fbddcd30 before 1962841387087970d75ba8b8d4c2aa2d45705e50CVE List
  • Linuxaffected: e32d262c89e2b22cb0640223f953b548617ed8a6 before 4b7abdcb5ba832fafab679f0d998af39cbc99307CVE List
  • Linuxaffected: e32d262c89e2b22cb0640223f953b548617ed8a6 before b2dbcc1ed48b5ac070a41db4a52aade6823c4df0CVE List
  • Linuxaffected: e32d262c89e2b22cb0640223f953b548617ed8a6 before ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9fCVE List
  • Linuxaffected: e32d262c89e2b22cb0640223f953b548617ed8a6 before 2b0f561f21b27c40c91ea4975268a06092bd7e9cCVE List
  • Linuxaffected: 8bfd391bde685df7289b928ce8876a3583be4bfbCVE List
  • Linuxaffected: 5.10.228 before 5.10.271CVE List
  • Linuxaffected: 5.15.169 before 5.15.222CVE List
  • Linuxaffected: 6.1.113 before 6.1.189CVE List
  • Linuxaffected: 6.6.57 before 6.6.158CVE List
  • Linuxaffected: 6.11.4 before 6.12CVE List
  • Linuxaffected: 6.12CVE List
  • Linuxunaffected: all versions before 6.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8