CVE-2026-97524mptcp: avoid unneeded actions on subflow reset
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again. Break the recursion loop explicitly checking for the exceptional condition. Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time. This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling. Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from fde99e972b8f88cebe619241d7aa43d288ef666a before 6d669c740933124eae3df8cfc15995af9bcc6aba; from 12c1676d598e3b8dd92a033b623b792cc2ea1ec5 before 83a7dcdd2b1060484528da70a643125174d47e5a; from 35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25 before a370e56024df0b07e3120c45a9773ae123819fd6; from b8be15d1ae7ea4eedd547c3b3141f592fbddcd30 before 1962841387087970d75ba8b8d4c2aa2d45705e50; from e32d262c89e2b22cb0640223f953b548617ed8a6 before 4b7abdcb5ba832fafab679f0d998af39cbc99307; from e32d262c89e2b22cb0640223f953b548617ed8a6 before b2dbcc1ed48b5ac070a41db4a52aade6823c4df0; from e32d262c89e2b22cb0640223f953b548617ed8a6 before ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f; from e32d262c89e2b22cb0640223f953b548617ed8a6 before 2b0f561f21b27c40c91ea4975268a06092bd7e9c; and 6 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/6d669c740933124eae3df8cfc15995af9bcc6aba
- https://git.kernel.org/stable/c/83a7dcdd2b1060484528da70a643125174d47e5a
- https://git.kernel.org/stable/c/a370e56024df0b07e3120c45a9773ae123819fd6
- https://git.kernel.org/stable/c/1962841387087970d75ba8b8d4c2aa2d45705e50
- https://git.kernel.org/stable/c/4b7abdcb5ba832fafab679f0d998af39cbc99307
- https://git.kernel.org/stable/c/b2dbcc1ed48b5ac070a41db4a52aade6823c4df0
- https://git.kernel.org/stable/c/ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f
- https://git.kernel.org/stable/c/2b0f561f21b27c40c91ea4975268a06092bd7e9c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.