CVE-2026-97566
Received Received - Intake

Memory Leak in Linux Kernel MPTCP Path Manager

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not tear down pending announcements, unlike the non-zero id path. When the PM later reselects id 0 after adding another signal endpoint, it finds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel()) in mptcp_pm_announced_alloc(). Root cause: asymmetry between removal paths. - Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls mptcp_pm_remove_announced() to clean up. - Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely. Fix by making the id 0 path symmetric: call mptcp_pm_announced_remove() and decrement add_addr_signaled before queuing the RM_ADDR. Subtle detail: signal endpoints are stored in anno_list with port 0, but msk_local carries the connection's local port. In other words, entries linked to ID0 paths should have port == 0. A follow-up patch will ensure that. mptcp_pm_announced_remove() uses use_port=true for comparison. So clear the port before the lookup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97566
EUVD
EUVD-2026-86874

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the Multipath TCP (MPTCP) path manager leaving stale ADD_ADDR announcement entries when removing the id 0 endpoint. The issue occurs because the removal path for id 0 does not clean up pending announcements, unlike paths for non-zero ids. This asymmetry can lead to a kernel warning when id 0 is reselected after adding another endpoint.

Impact Analysis

This vulnerability may cause kernel warnings or instability in systems using MPTCP with the in-kernel path manager. It could lead to unexpected behavior or crashes if the stale ADD_ADDR entry is accessed during normal operations.

Mitigation Strategies

Apply the Linux kernel patch that resolves the MPTCP path manager issue. Update to a kernel version containing the fix for CVE-2026-97566. Monitor kernel logs for WARN_ON_ONCE(mptcp_pm_is_kernel()) errors indicating stale ADD_ADDR entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97566. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart