CVE-2026-97566

Received Received - Intake

Memory Leak in Linux Kernel MPTCP Path Manager

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not tear down pending announcements, unlike the non-zero id path. When the PM later reselects id 0 after adding another signal endpoint, it finds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel()) in mptcp_pm_announced_alloc(). Root cause: asymmetry between removal paths. - Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls mptcp_pm_remove_announced() to clean up. - Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely. Fix by making the id 0 path symmetric: call mptcp_pm_announced_remove() and decrement add_addr_signaled before queuing the RM_ADDR. Subtle detail: signal endpoints are stored in anno_list with port 0, but msk_local carries the connection's local port. In other words, entries linked to ID0 paths should have port == 0. A follow-up patch will ensure that. mptcp_pm_announced_remove() uses use_port=true for comparison. So clear the port before the lookup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97566

EUVD

EUVD-2026-86874

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the Multipath TCP (MPTCP) path manager leaving stale ADD_ADDR announcement entries when removing the id 0 endpoint. The issue occurs because the removal path for id 0 does not clean up pending announcements, unlike paths for non-zero ids. This asymmetry can lead to a kernel warning when id 0 is reselected after adding another endpoint.

Detection Guidance

This vulnerability is specific to the Linux kernel's MPTCP (Multipath TCP) path manager and may not have direct network detection commands. It involves a kernel-level issue where stale ADD_ADDR entries persist when removing the id 0 endpoint. Monitoring kernel logs for MPTCP-related warnings or errors, particularly those referencing mptcp_pm_announced_alloc() or WARN_ON_ONCE(mptcp_pm_is_kernel()), could indicate exploitation or presence of this issue.

Impact Analysis

This vulnerability may cause kernel warnings or instability in systems using MPTCP with the in-kernel path manager. It could lead to unexpected behavior or crashes if the stale ADD_ADDR entry is accessed during normal operations.

Compliance Impact

This vulnerability is specific to the Linux kernel's MPTCP (Multipath TCP) path manager and does not directly impact compliance with standards like GDPR or HIPAA. It involves a kernel-level networking issue that could lead to system instability or crashes but does not involve data exposure or privacy violations typically addressed by these regulations.

Mitigation Strategies

Apply the Linux kernel patch that resolves the MPTCP path manager issue. Update to a kernel version containing the fix for CVE-2026-97566. Monitor kernel logs for WARN_ON_ONCE(mptcp_pm_is_kernel()) errors indicating stale ADD_ADDR entries.

Hi! I’m here to help you understand CVE-2026-97566. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70