CVE-2026-97523 (GCVE-0-2026-97523)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41
VLAI
Title
mptcp: close race between scheduler and state change
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: close race between scheduler and state change The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mss_now reset to 0 for a divide operation. Address the issue by explicitly checking for the critical scenario.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c886d70286bf3ad411eb3d689328a67f7102c6ae , < 8f11430d51ff8365bc51b670bc3002b65ae4c6b7 (git)
Affected: c886d70286bf3ad411eb3d689328a67f7102c6ae , < a09c87abf10a0a7e203137c75b5381aa63d9b31d (git)
Affected: c886d70286bf3ad411eb3d689328a67f7102c6ae , < 4c856f3c151a2f3fa237caa651c44015916ca584 (git)
Affected: c886d70286bf3ad411eb3d689328a67f7102c6ae , < 42064de57fb83231fcc89663a94885f228a1ee53 (git)
Affected: fb9c73ef2ac2ec816efdc8b9267bc04e1369c20b (git)
Affected: 8caf5c15b5288d52d9c89374d6c10fa32ee84ec5 (git)
Affected: 5.15.190 , < 5.16 (semver)
Affected: 5.19.4 , < 5.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f11430d51ff8365bc51b670bc3002b65ae4c6b7",
              "status": "affected",
              "version": "c886d70286bf3ad411eb3d689328a67f7102c6ae",
              "versionType": "git"
            },
            {
              "lessThan": "a09c87abf10a0a7e203137c75b5381aa63d9b31d",
              "status": "affected",
              "version": "c886d70286bf3ad411eb3d689328a67f7102c6ae",
              "versionType": "git"
            },
            {
              "lessThan": "4c856f3c151a2f3fa237caa651c44015916ca584",
              "status": "affected",
              "version": "c886d70286bf3ad411eb3d689328a67f7102c6ae",
              "versionType": "git"
            },
            {
              "lessThan": "42064de57fb83231fcc89663a94885f228a1ee53",
              "status": "affected",
              "version": "c886d70286bf3ad411eb3d689328a67f7102c6ae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fb9c73ef2ac2ec816efdc8b9267bc04e1369c20b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8caf5c15b5288d52d9c89374d6c10fa32ee84ec5",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: close race between scheduler and state change\n\nThe mptcp scheduler may race with subflow sockets state change: data\ntransmission on the selected socket may fail and a later release could\ntry to use mss_now reset to 0 for a divide operation.\n\nAddress the issue by explicitly checking for the critical scenario."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - mptcp_push_release is reached from __mptcp_push_pending after mptcp_sched_get_send. A remote MPTCP peer changes the selected subflow\u0027s sk_state via TCP RST/FIN (tcp_v4_rcv/tcp_rcv_established/tcp_reset) without the msk lock, and a DSS DATA_ACK (mptcp_incoming_options\u2192ack_update_msk) sets MPTCP_PUSH_PENDING so mptcp_release_cb calls that push.\nAC:L - The attacker creates both halves of the race: they induce __mptcp_push_pending (DSS DATA_ACK, or eliciting mptcp_sendmsg) so mptcp_subflow_get_send snapshots __tcp_can_send without the ssk lock, then RST/FIN/MP_FAIL that subflow before lock_sock; the window is attacker-timed and retryable, not an uninfluencable layout.\nPR:N - Completing MP_CAPABLE to an IPPROTO_MPTCP listener needs no account or capability; net.mptcp.enabled defaults to 1 in mptcp pernet init, and tcp_rcv_established/mptcp_incoming_options apply no application credentials before the DATA_ACK and RST/FIN that cause this race.\nUI:N - The attacker sends the DATA_ACK and RST/FIN themselves and supplies the request that makes the service call mptcp_sendmsg; no victim mount, click, or extra confirmation is required.\nS:U - The divide-error runs in tcp_tso_autosize/tcp_set_skb_tso_segs on the host kernel MPTCP/TCP socket; it does not cross a VM, IOMMU, or sandbox boundary.\nC:N - When __tcp_can_send fails in mptcp_sendmsg_frag, info-\u003emss_now stays 0 and tcp_push divides by zero; that CPU exception does not read freed objects or out-of-range kernel memory.\nI:N - tcp_write_xmit aborts on the divide in tcp_tso_autosize/tcp_set_skb_tso_segs before modifying TCP control blocks or packet contents; this is not an OOB/UAF write or control-flow hijack.\nA:H - bytes/mss_now in tcp_tso_autosize and DIV_ROUND_UP(skb-\u003elen, mss_now) in tcp_set_skb_tso_segs raise a kernel divide-error oops/panic from mptcp_push_release, and the attacker can repeat it across MPTCP connections."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:04.318Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f11430d51ff8365bc51b670bc3002b65ae4c6b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a09c87abf10a0a7e203137c75b5381aa63d9b31d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c856f3c151a2f3fa237caa651c44015916ca584"
        },
        {
          "url": "https://git.kernel.org/stable/c/42064de57fb83231fcc89663a94885f228a1ee53"
        }
      ],
      "title": "mptcp: close race between scheduler and state change",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97523",
    "datePublished": "2026-09-25T10:21:27.042Z",
    "dateReserved": "2026-09-24T16:01:01.152Z",
    "dateUpdated": "2026-09-25T14:41:04.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97523",
      "date": "2026-09-28",
      "epss": "0.00603",
      "percentile": "0.46741"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T00:18:38.000Z",
      "cve": "CVE-2026-97523",
      "id": "msrc_CVE-2026-97523",
      "initial_release_date": "2026-09-28T00:18:38.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mptcp: close race between scheduler and state change",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97523.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/protocol.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8f11430d51ff8365bc51b670bc3002b65ae4c6b7",
                    "status": "affected",
                    "version": "c886d70286bf3ad411eb3d689328a67f7102c6ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a09c87abf10a0a7e203137c75b5381aa63d9b31d",
                    "status": "affected",
                    "version": "c886d70286bf3ad411eb3d689328a67f7102c6ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4c856f3c151a2f3fa237caa651c44015916ca584",
                    "status": "affected",
                    "version": "c886d70286bf3ad411eb3d689328a67f7102c6ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "42064de57fb83231fcc89663a94885f228a1ee53",
                    "status": "affected",
                    "version": "c886d70286bf3ad411eb3d689328a67f7102c6ae",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "fb9c73ef2ac2ec816efdc8b9267bc04e1369c20b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8caf5c15b5288d52d9c89374d6c10fa32ee84ec5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.190",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.20",
                    "status": "affected",
                    "version": "5.19.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/protocol.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.0"
                  },
                  {
                    "lessThan": "6.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: close race between scheduler and state change\n\nThe mptcp scheduler may race with subflow sockets state change: data\ntransmission on the selected socket may fail and a later release could\ntry to use mss_now reset to 0 for a divide operation.\n\nAddress the issue by explicitly checking for the critical scenario."
          }
        ],
        "id": "CVE-2026-97523",
        "lastModified": "2026-09-25T15:17:57.653",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:02.407",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/42064de57fb83231fcc89663a94885f228a1ee53"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4c856f3c151a2f3fa237caa651c44015916ca584"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f11430d51ff8365bc51b670bc3002b65ae4c6b7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a09c87abf10a0a7e203137c75b5381aa63d9b31d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-28T18:53:58+00:00",
      "cve": "CVE-2026-97523",
      "id": "CVE-2026-97523",
      "initial_release_date": "2026-09-25T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: close race between scheduler and state change",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97523.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.