{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97524", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.152Z", "datePublished": "2026-09-25T10:21:27.668Z", "dateUpdated": "2026-09-25T14:41:05.413Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T14:41:05.413Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid unneeded actions on subflow reset\n\nOnce in a blue moon, the mptcp receive path can recursively call\nmptcp_data_ready() via state change under unlucky error conditions, and\nthen try to hold the data lock again.\n\nBreak the recursion loop explicitly checking for the exceptional\ncondition.\n\nAdd a new flag instead of using an existing one like 'closing', to exit\nearly in subflow_state_change(), and explicitly flush the RX queue at\nreset time.\n\nThis avoids unneeded processing to check for available data -- calling\nget_mapping_status() and more on a dying subflow -- but also in error\nreporting and worker scheduling.\n\nNote that we must consume the currently peeked skb before invoking\nmptcp_dss_corruption to avoid consuming it again after the eventual\nreset has freed it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - A crafted MPTCP DSS option on a received TCP segment is the attacker-controlled input; it is parsed on the established RX path tcp_rcv_established \u2192 tcp_data_queue \u2192 subflow_data_ready \u2192 mptcp_data_ready \u2192 __mptcp_move_skbs_from_subflow, which calls mptcp_dss_corruption() and then the patched mptcp_subflow_reset()/subflow_state_change(). MPTCP/TCP is a routable IP protocol.\nAC:L - The peer disables infinite fallback via MP_JOIN (mptcp_subflow_joined(); allow_join_initial_addr_port defaults to 1) or by filling msk->out_of_order_queue, then sends a DSS with data_len shorter than the skb plus another TCP-ofo segment so map_remaining < len in __mptcp_move_skbs_from_subflow() calls mptcp_subflow_reset() while ssk->sk_receive_queue is still occupied, making subflow_state_change() re-enter mptcp_data_ready().\nPR:N - The DSS is processed in TCP receive softirq after an unauthenticated MP_CAPABLE handshake with an IPPROTO_MPTCP listener (or an outbound MPTCP client); no local account, capability, or application credential is checked on the path to mptcp_dss_corruption().\nUI:N - The attacker\u2019s DSS segments are handled entirely in RX softirq on an existing MPTCP connection; no local user mount, file open, or other victim action is required.\nS:U - The recursive mptcp_data_lock hang and subflow teardown stay inside the victim kernel\u2019s network stack; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a nested spin_lock_bh on sk->sk_lock.slock from subflow_state_change() back into mptcp_data_ready(); it does not read attacker-chosen kernel memory or leak pointers.\nI:N - Pre-fix tcp_done() does not purge ssk->sk_receive_queue, and the nested mptcp_data_ready() never proceeds past the already-held slock, so there is no use-after-free, write primitive, or control-flow hijack.\nA:H - mptcp_data_ready() already holds mptcp_data_lock (spin_lock_bh on sk->sk_lock.slock) when mptcp_dss_corruption() \u2192 mptcp_subflow_reset() \u2192 tcp_done() invokes subflow_state_change(), which re-enters mptcp_data_ready() and deadlocks the CPU in softirq (soft lockup)."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.c", "net/mptcp/protocol.h", "net/mptcp/subflow.c"], "versions": [{"version": "e32d262c89e2b22cb0640223f953b548617ed8a6", "lessThan": "4b7abdcb5ba832fafab679f0d998af39cbc99307", "status": "affected", "versionType": "git"}, {"version": "e32d262c89e2b22cb0640223f953b548617ed8a6", "lessThan": "b2dbcc1ed48b5ac070a41db4a52aade6823c4df0", "status": "affected", "versionType": "git"}, {"version": "e32d262c89e2b22cb0640223f953b548617ed8a6", "lessThan": "ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f", "status": "affected", "versionType": "git"}, {"version": "e32d262c89e2b22cb0640223f953b548617ed8a6", "lessThan": "2b0f561f21b27c40c91ea4975268a06092bd7e9c", "status": "affected", "versionType": "git"}, {"version": "fde99e972b8f88cebe619241d7aa43d288ef666a", "status": "affected", "versionType": "git"}, {"version": "12c1676d598e3b8dd92a033b623b792cc2ea1ec5", "status": "affected", "versionType": "git"}, {"version": "35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25", "status": "affected", "versionType": "git"}, {"version": "b8be15d1ae7ea4eedd547c3b3141f592fbddcd30", "status": "affected", "versionType": "git"}, {"version": "8bfd391bde685df7289b928ce8876a3583be4bfb", "status": "affected", "versionType": "git"}, {"version": "5.10.228", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.169", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.1.113", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.6.57", "lessThan": "6.7", "status": "affected", "versionType": "semver"}, {"version": "6.11.4", "lessThan": "6.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.c", "net/mptcp/protocol.h", "net/mptcp/subflow.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.3-rc4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.228"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.169"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4b7abdcb5ba832fafab679f0d998af39cbc99307"}, {"url": "https://git.kernel.org/stable/c/b2dbcc1ed48b5ac070a41db4a52aade6823c4df0"}, {"url": "https://git.kernel.org/stable/c/ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f"}, {"url": "https://git.kernel.org/stable/c/2b0f561f21b27c40c91ea4975268a06092bd7e9c"}], "title": "mptcp: avoid unneeded actions on subflow reset", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mptcp/protocol.c", "net/mptcp/protocol.h", "net/mptcp/subflow.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4b7abdcb5ba832fafab679f0d998af39cbc99307", "status": "affected", "version": "e32d262c89e2b22cb0640223f953b548617ed8a6", "versionType": "git"}, {"lessThan": "b2dbcc1ed48b5ac070a41db4a52aade6823c4df0", "status": "affected", "version": "e32d262c89e2b22cb0640223f953b548617ed8a6", "versionType": "git"}, {"lessThan": "ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f", "status": "affected", "version": "e32d262c89e2b22cb0640223f953b548617ed8a6", "versionType": "git"}, {"lessThan": "2b0f561f21b27c40c91ea4975268a06092bd7e9c", "status": "affected", "version": "e32d262c89e2b22cb0640223f953b548617ed8a6", "versionType": "git"}, {"status": "affected", "version": "fde99e972b8f88cebe619241d7aa43d288ef666a", "versionType": "git"}, {"status": "affected", "version": "12c1676d598e3b8dd92a033b623b792cc2ea1ec5", "versionType": "git"}, {"status": "affected", "version": "35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25", "versionType": "git"}, {"status": "affected", "version": "b8be15d1ae7ea4eedd547c3b3141f592fbddcd30", "versionType": "git"}, {"status": "affected", "version": "8bfd391bde685df7289b928ce8876a3583be4bfb", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.228", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.169", "versionType": "semver"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.113", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.57", "versionType": "semver"}, {"lessThan": "6.12", "status": "affected", "version": "6.11.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mptcp/protocol.c", "net/mptcp/protocol.h", "net/mptcp/subflow.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc4", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid unneeded actions on subflow reset\n\nOnce in a blue moon, the mptcp receive path can recursively call\nmptcp_data_ready() via state change under unlucky error conditions, and\nthen try to hold the data lock again.\n\nBreak the recursion loop explicitly checking for the exceptional\ncondition.\n\nAdd a new flag instead of using an existing one like 'closing', to exit\nearly in subflow_state_change(), and explicitly flush the RX queue at\nreset time.\n\nThis avoids unneeded processing to check for available data -- calling\nget_mapping_status() and more on a dying subflow -- but also in error\nreporting and worker scheduling.\n\nNote that we must consume the currently peeked skb before invoking\nmptcp_dss_corruption to avoid consuming it again after the eventual\nreset has freed it."}], "id": "CVE-2026-97524", "lastModified": "2026-09-25T15:17:57.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:02.520", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2b0f561f21b27c40c91ea4975268a06092bd7e9c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4b7abdcb5ba832fafab679f0d998af39cbc99307"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b2dbcc1ed48b5ac070a41db4a52aade6823c4df0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mptcp: avoid unneeded actions on subflow reset", "id": "2541186", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541186"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-764", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmptcp: avoid unneeded actions on subflow reset\nOnce in a blue moon, the mptcp receive path can recursively call\nmptcp_data_ready() via state change under unlucky error conditions, and\nthen try to hold the data lock again.\nBreak the recursion loop explicitly checking for the exceptional\ncondition.\nAdd a new flag instead of using an existing one like 'closing', to exit\nearly in subflow_state_change(), and explicitly flush the RX queue at\nreset time.\nThis avoids unneeded processing to check for available data -- calling\nget_mapping_status() and more on a dying subflow -- but also in error\nreporting and worker scheduling.\nNote that we must consume the currently peeked skb before invoking\nmptcp_dss_corruption to avoid consuming it again after the eventual\nreset has freed it.", "A flaw was found in the Linux kernel's MultiPath TCP (MPTCP) subsystem. Under specific network error and subflow reset conditions during data receive operations, the kernel can enter a recursive call loop that attempts to acquire an already-held data lock. A remote attacker communicating over an MPTCP connection could trigger these conditions to cause a kernel deadlock, resulting in a system freeze and a Denial of Service (DoS)."], "name": "CVE-2026-97524", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97524\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97524\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97524.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e32d262c89e2b22cb0640223f953b548617ed8a6,4b7abdcb5ba832fafab679f0d998af39cbc99307)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e32d262c89e2b22cb0640223f953b548617ed8a6,b2dbcc1ed48b5ac070a41db4a52aade6823c4df0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e32d262c89e2b22cb0640223f953b548617ed8a6,ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e32d262c89e2b22cb0640223f953b548617ed8a6,2b0f561f21b27c40c91ea4975268a06092bd7e9c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "fde99e972b8f88cebe619241d7aa43d288ef666a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "12c1676d598e3b8dd92a033b623b792cc2ea1ec5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b8be15d1ae7ea4eedd547c3b3141f592fbddcd30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8bfd391bde685df7289b928ce8876a3583be4bfb"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.228,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.169,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.113,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.57,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.11.4,6.12)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:30:15.451947+00:00", "updated": "2026-10-01T12:00:06.849619+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}