CVE-2026-97524: mptcp: avoid unneeded actions on subflow reset

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again. Break the recursion loop explicitly checking for the exceptional condition. Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time. This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling. Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it.

Affected products

Linux kernel: from 5.10.228 before 5.10.271; from 5.15.169 before 5.15.222; from 6.1.113 before 6.1.189; from 6.6.57 before 6.6.158; from 6.11.4 before 6.12; 6.12 — fixed in 5.10.271, 5.15.222, 6.1.189, 6.12, 6.6.158, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 5.10.271, 5.15.222, 6.1.189, 6.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-97524 or the next vulnerability affects your stack