What’s Vulnerable › Vulnerabilities

CVE-2026-97522: mptcp: fix bad accounting in __mptcp_subflow_push_pending()

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix bad accounting in __mptcp_subflow_push_pending() If __subflow_push_pending() errors out we should avoid updating the copied byte counters, to avoid mismatch push call later on.

Affected products

• Linux kernel: 6.6 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/9781fa35d9f7a87a83115acd3a88bc9ce35b5407
• https://git.kernel.org/stable/c/a0a64525f3414268ed4b1945a1dc690aa974dd4f
• https://git.kernel.org/stable/c/dc054821e639a2e14f1419436612db70b6af45fc
• https://git.kernel.org/stable/c/ddbf9f03c1cc7d5b86eebe7c2beea0db4286d354
• https://git.kernel.org/stable/c/f3ef03357396d4b147d8e76c75fb612c2f264ffc

Get alerted when CVE-2026-97522 or the next vulnerability affects your stack