All vulnerabilities
CVE-2026-98438

Linux: mptcp: options: fix uninit-value in mptcp_write_data_fin

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9a682067dd7b9dce6b94a0a05661dcc921446402Fixed versionCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 9a682067dd7b9dce6b94a0a05661dcc921446402LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: options: fix uninit-value in mptcp_write_data_fin

When sending a DATA_FIN without data, and because the DATA_FIN occupies 1 octet of the connection-level sequence space [1], it is then required to add a DSS mapping with specific values.

If the checksum has been negotiated, it also needs to be computed, and included in the outgoing packet, and thus the initial csum data needs to be reset to 0 as well. This is no longer the case since commit cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()"), because the whole ext_copy structure is no longer zeroed by default.

This seems to be the only case where use_map is changed and set afterwards, so initialising the csum field only in this case, along with other fields for this specific case.

Text from CVE List

Affected versions 6

  • Linuxaffected: cfcceb7a39fc10a6f896af8229bf81d96acb22cc before 9a682067dd7b9dce6b94a0a05661dcc921446402CVE List
  • Linuxaffected: cfcceb7a39fc10a6f896af8229bf81d96acb22cc before b110f1dd6cb6a9930503354a01a315e0a821eaa7CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2