CVE-2026-97524 (GCVE-0-2026-97524)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41
VLAI
Title
mptcp: avoid unneeded actions on subflow reset
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again. Break the recursion loop explicitly checking for the exceptional condition. Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time. This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling. Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e32d262c89e2b22cb0640223f953b548617ed8a6 , < 4b7abdcb5ba832fafab679f0d998af39cbc99307 (git)
Affected: e32d262c89e2b22cb0640223f953b548617ed8a6 , < b2dbcc1ed48b5ac070a41db4a52aade6823c4df0 (git)
Affected: e32d262c89e2b22cb0640223f953b548617ed8a6 , < ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f (git)
Affected: e32d262c89e2b22cb0640223f953b548617ed8a6 , < 2b0f561f21b27c40c91ea4975268a06092bd7e9c (git)
Affected: fde99e972b8f88cebe619241d7aa43d288ef666a (git)
Affected: 12c1676d598e3b8dd92a033b623b792cc2ea1ec5 (git)
Affected: 35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25 (git)
Affected: b8be15d1ae7ea4eedd547c3b3141f592fbddcd30 (git)
Affected: 8bfd391bde685df7289b928ce8876a3583be4bfb (git)
Affected: 5.10.228 , < 5.11 (semver)
Affected: 5.15.169 , < 5.16 (semver)
Affected: 6.1.113 , < 6.2 (semver)
Affected: 6.6.57 , < 6.7 (semver)
Affected: 6.11.4 , < 6.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b7abdcb5ba832fafab679f0d998af39cbc99307",
              "status": "affected",
              "version": "e32d262c89e2b22cb0640223f953b548617ed8a6",
              "versionType": "git"
            },
            {
              "lessThan": "b2dbcc1ed48b5ac070a41db4a52aade6823c4df0",
              "status": "affected",
              "version": "e32d262c89e2b22cb0640223f953b548617ed8a6",
              "versionType": "git"
            },
            {
              "lessThan": "ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f",
              "status": "affected",
              "version": "e32d262c89e2b22cb0640223f953b548617ed8a6",
              "versionType": "git"
            },
            {
              "lessThan": "2b0f561f21b27c40c91ea4975268a06092bd7e9c",
              "status": "affected",
              "version": "e32d262c89e2b22cb0640223f953b548617ed8a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fde99e972b8f88cebe619241d7aa43d288ef666a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "12c1676d598e3b8dd92a033b623b792cc2ea1ec5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8be15d1ae7ea4eedd547c3b3141f592fbddcd30",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8bfd391bde685df7289b928ce8876a3583be4bfb",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.228",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.169",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.57",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.228",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.169",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.113",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid unneeded actions on subflow reset\n\nOnce in a blue moon, the mptcp receive path can recursively call\nmptcp_data_ready() via state change under unlucky error conditions, and\nthen try to hold the data lock again.\n\nBreak the recursion loop explicitly checking for the exceptional\ncondition.\n\nAdd a new flag instead of using an existing one like \u0027closing\u0027, to exit\nearly in subflow_state_change(), and explicitly flush the RX queue at\nreset time.\n\nThis avoids unneeded processing to check for available data -- calling\nget_mapping_status() and more on a dying subflow -- but also in error\nreporting and worker scheduling.\n\nNote that we must consume the currently peeked skb before invoking\nmptcp_dss_corruption to avoid consuming it again after the eventual\nreset has freed it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A crafted MPTCP DSS option on a received TCP segment is the attacker-controlled input; it is parsed on the established RX path tcp_rcv_established \u2192 tcp_data_queue \u2192 subflow_data_ready \u2192 mptcp_data_ready \u2192 __mptcp_move_skbs_from_subflow, which calls mptcp_dss_corruption() and then the patched mptcp_subflow_reset()/subflow_state_change(). MPTCP/TCP is a routable IP protocol.\nAC:L - The peer disables infinite fallback via MP_JOIN (mptcp_subflow_joined(); allow_join_initial_addr_port defaults to 1) or by filling msk-\u003eout_of_order_queue, then sends a DSS with data_len shorter than the skb plus another TCP-ofo segment so map_remaining \u003c len in __mptcp_move_skbs_from_subflow() calls mptcp_subflow_reset() while ssk-\u003esk_receive_queue is still occupied, making subflow_state_change() re-enter mptcp_data_ready().\nPR:N - The DSS is processed in TCP receive softirq after an unauthenticated MP_CAPABLE handshake with an IPPROTO_MPTCP listener (or an outbound MPTCP client); no local account, capability, or application credential is checked on the path to mptcp_dss_corruption().\nUI:N - The attacker\u2019s DSS segments are handled entirely in RX softirq on an existing MPTCP connection; no local user mount, file open, or other victim action is required.\nS:U - The recursive mptcp_data_lock hang and subflow teardown stay inside the victim kernel\u2019s network stack; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a nested spin_lock_bh on sk-\u003esk_lock.slock from subflow_state_change() back into mptcp_data_ready(); it does not read attacker-chosen kernel memory or leak pointers.\nI:N - Pre-fix tcp_done() does not purge ssk-\u003esk_receive_queue, and the nested mptcp_data_ready() never proceeds past the already-held slock, so there is no use-after-free, write primitive, or control-flow hijack.\nA:H - mptcp_data_ready() already holds mptcp_data_lock (spin_lock_bh on sk-\u003esk_lock.slock) when mptcp_dss_corruption() \u2192 mptcp_subflow_reset() \u2192 tcp_done() invokes subflow_state_change(), which re-enters mptcp_data_ready() and deadlocks the CPU in softirq (soft lockup)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:05.413Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b7abdcb5ba832fafab679f0d998af39cbc99307"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2dbcc1ed48b5ac070a41db4a52aade6823c4df0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b0f561f21b27c40c91ea4975268a06092bd7e9c"
        }
      ],
      "title": "mptcp: avoid unneeded actions on subflow reset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97524",
    "datePublished": "2026-09-25T10:21:27.668Z",
    "dateReserved": "2026-09-24T16:01:01.152Z",
    "dateUpdated": "2026-09-25T14:41:05.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97524",
      "date": "2026-09-28",
      "epss": "0.00603",
      "percentile": "0.46741"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-27T23:46:23.000Z",
      "cve": "CVE-2026-97524",
      "id": "msrc_CVE-2026-97524",
      "initial_release_date": "2026-09-27T23:46:23.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mptcp: avoid unneeded actions on subflow reset",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97524.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/protocol.c",
                  "net/mptcp/protocol.h",
                  "net/mptcp/subflow.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4b7abdcb5ba832fafab679f0d998af39cbc99307",
                    "status": "affected",
                    "version": "e32d262c89e2b22cb0640223f953b548617ed8a6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b2dbcc1ed48b5ac070a41db4a52aade6823c4df0",
                    "status": "affected",
                    "version": "e32d262c89e2b22cb0640223f953b548617ed8a6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f",
                    "status": "affected",
                    "version": "e32d262c89e2b22cb0640223f953b548617ed8a6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b0f561f21b27c40c91ea4975268a06092bd7e9c",
                    "status": "affected",
                    "version": "e32d262c89e2b22cb0640223f953b548617ed8a6",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "fde99e972b8f88cebe619241d7aa43d288ef666a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "12c1676d598e3b8dd92a033b623b792cc2ea1ec5",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b8be15d1ae7ea4eedd547c3b3141f592fbddcd30",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8bfd391bde685df7289b928ce8876a3583be4bfb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "affected",
                    "version": "5.10.228",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.169",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "affected",
                    "version": "6.1.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "affected",
                    "version": "6.6.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "affected",
                    "version": "6.11.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/protocol.c",
                  "net/mptcp/protocol.h",
                  "net/mptcp/subflow.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid unneeded actions on subflow reset\n\nOnce in a blue moon, the mptcp receive path can recursively call\nmptcp_data_ready() via state change under unlucky error conditions, and\nthen try to hold the data lock again.\n\nBreak the recursion loop explicitly checking for the exceptional\ncondition.\n\nAdd a new flag instead of using an existing one like \u0027closing\u0027, to exit\nearly in subflow_state_change(), and explicitly flush the RX queue at\nreset time.\n\nThis avoids unneeded processing to check for available data -- calling\nget_mapping_status() and more on a dying subflow -- but also in error\nreporting and worker scheduling.\n\nNote that we must consume the currently peeked skb before invoking\nmptcp_dss_corruption to avoid consuming it again after the eventual\nreset has freed it."
          }
        ],
        "id": "CVE-2026-97524",
        "lastModified": "2026-09-25T15:17:57.773",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:02.520",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2b0f561f21b27c40c91ea4975268a06092bd7e9c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4b7abdcb5ba832fafab679f0d998af39cbc99307"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b2dbcc1ed48b5ac070a41db4a52aade6823c4df0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.