CVE-2026-97524
Received Received - Intake

MPTCP Subflow Reset Handling Issue in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again. Break the recursion loop explicitly checking for the exceptional condition. Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time. This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling. Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97524
EUVD
EUVD-2026-86832

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a recursion issue in the MPTCP receive path. Under rare error conditions, the mptcp_data_ready function can call itself repeatedly, leading to unnecessary processing. The fix introduces a new flag to break this recursion loop and explicitly flushes the RX queue during subflow reset to avoid redundant operations like checking for available data or scheduling workers.

Detection Guidance

This vulnerability is specific to the Linux kernel's MPTCP (Multipath TCP) implementation. Detection would require checking kernel logs for MPTCP-related errors or unusual behavior during subflow resets. Commands like 'dmesg | grep mptcp' or 'journalctl -k | grep mptcp' may help identify issues. Ensure your kernel version is up to date to avoid this vulnerability.

Impact Analysis

This vulnerability may cause unnecessary CPU usage and delayed processing due to repeated recursion in the MPTCP receive path. It could lead to performance degradation or temporary unresponsiveness in systems using MPTCP, though it does not directly expose data or allow privilege escalation.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. This resolves the issue by preventing recursive calls in the MPTCP receive path during subflow resets. Monitor kernel logs for any MPTCP-related errors after the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97524. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart