Skip to main content

Linux Kernel EUVDEUVD-2026-86831

| CVE-2026-97523 HIGH
2026-09-25 Linux GHSA-7c5c-gph2-xxg8
Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Establish MPTCP connection to host
  2. Delivery
    Trigger subflow state change mid-transmission
  3. Exploit
    Win scheduler-vs-state-change race
  4. Execution
    mss_now=0 used in divide
  5. Impact
    Kernel divide-by-zero crash (DoS)

Vulnerability Assessment

Exploitation Conditions

Requires the target Linux host to have MPTCP compiled in and in active use (CONFIG_MPTCP with a multipath connection carrying multiple subflows) - single-path TCP is unaffected. Triggering needs a race window: the MPTCP scheduler must select a subflow for data transmission at the same instant that subflow's socket state changes and the send fails, leaving mss_now at 0 for a later release-path division. This timing dependence (not deterministically attacker-controlled) is the primary limiting factor; no authentication or user interaction is required, but successful triggering is probabilistic rather than reliable.
Impact

This is a pure availability (denial-of-service) bug, not the information disclosure its tag claims: the NVD CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H explicitly sets C:N/I:N with only A:H, and the root cause is a divide-by-zero (mss_now reset to 0 used in a division) reachable when the MPTCP scheduler races with a subflow socket state change during a failed transmission and a later release path. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The NVD AC:L rating appears understated: this is a narrow-timing kernel race triggered by a transmission failure coinciding with a socket state change, which an attacker cannot deterministically control - AC:H is more defensible, lowering the realistic score to roughly 5.9. Net assessment: a legitimate crash/DoS worth patching on MPTCP-enabled fleets, but the 7.5 'HIGH' with AC:L overstates ease of remote triggering; treat as a robustness/hardening fix rather than a high-priority actively-exploited threat.
Exploit ScenarioDerived

A remote peer maintains an MPTCP connection to a Linux host and induces a subflow socket to change state (e.g., resetting or tearing down a path) at the moment the MPTCP scheduler selects that subflow for transmission; the failed send leaves mss_now at 0, and the subsequent release path performs a division by it, causing a divide-by-zero kernel fault and crash. No public proof-of-concept is identified in the available data, and reliably hitting the race window is difficult.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Divide-by-zero in the Linux kernel's Multipath TCP (MPTCP) scheduler allows an unauthenticated remote peer to crash an affected host, because a race between subflow selection for transmission and a subflow socket state change can leave the connection's MSS value (mss_now) reset to zero, which is then used as a divisor on a later release path. Only systems built with CONFIG_MPTCP and carrying multipath connections with multiple subflows are exposed - single-path TCP is unaffected - and successful triggering depends on hitting a narrow timing window rather than deterministic attacker control, consistent with an assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact, no confidentiality or integrity loss). No public exploit code and no evidence of active exploitation were identified at time of analysis, and although the CVE is tagged 'Information Disclosure', the described behavior and the CVSS vector indicate a pure denial-of-service defect.

RemediationAI

Vendor-released patch: stable kernels 6.12.111, 6.18.53 and 7.2.7 contain the fix, and upstream 7.3-rc4 carries the corresponding change; the specific upstream commits are 8f11430d51ff8365bc51b670bc3002b65ae4c6b7, 4c856f3c151a2f3fa237caa651c44015916ca584, 42064de57fb83231fcc89663a94885f228a1ee53 and a09c87abf10a0a7e203137c75b5381aa63d9b31d, with details linked from https://nvd.nist.gov/vuln/detail/CVE-2026-97523. Apply the distribution's kernel update that backports these commits, or rebuild from a patched stable tree; because the flaw is reachable only when MPTCP is compiled in and negotiating multiple subflows, the most effective interim workaround is to disable MPTCP entirely (for example via sysctl net.mptcp.enabled=0, or by building without CONFIG_MPTCP), which removes the attack surface at the cost of losing multipath aggregation and failover - traffic then falls back to ordinary single-path TCP with no functional loss for hosts that do not use MPTCP. Restricting kernel exposure is preferable to network filtering here, since the race is triggered on the local subflow state machine rather than by a specific packet signature, so firewall rules cannot reliably block it, and limiting the number of negotiated subflows may reduce but not eliminate the race window. Reboot after patching, since the vulnerable code runs in-kernel and cannot be hot-reloaded. No public exploit code or active exploitation was reported at time of analysis, so prioritization should be based on whether MPTCP is actually in use rather than on urgent exploitation pressure.

Affected VersionsENISA

Linux patch: 0
Linux 6.0
Linux c886d70286bf3ad411eb3d689328a67f7102c6ae <8f11430d51ff8365bc51b670bc3002b65ae4c6b7
Linux 8caf5c15b5288d52d9c89374d6c10fa32ee84ec5
Linux c886d70286bf3ad411eb3d689328a67f7102c6ae <4c856f3c151a2f3fa237caa651c44015916ca584
Linux c886d70286bf3ad411eb3d689328a67f7102c6ae <42064de57fb83231fcc89663a94885f228a1ee53
Linux patch: 7.2.7
Linux patch: 6.18.53
Linux patch: 6.12.111
Linux 5.19.4 <5.20
Linux c886d70286bf3ad411eb3d689328a67f7102c6ae <a09c87abf10a0a7e203137c75b5381aa63d9b31d
Linux fb9c73ef2ac2ec816efdc8b9267bc04e1369c20b
Linux patch: 7.3-rc4
Linux 5.15.190 <5.16

Affected Packages

euvd linux fix: 5.16, 5.20

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

MPTCP extends TCP with multiple subflows, and the in-kernel path manager/scheduler chooses which subflow carries payload at send time; each subflow is backed by its own TCP socket state, including the negotiated MSS value (mss_now) used for segmentation arithmetic. The defect is a concurrency bug in that selection/release logic: if the scheduler picks a subflow for transmission exactly as that subflow's socket state changes, the send can fail and mss_now can be left at 0, so a subsequent release path performs a division by that zero value, producing a kernel oops/panic on the affected host. The described root cause corresponds to a race condition (CWE-362) that enables a divide-by-zero (CWE-369); the CVE record itself lists no CWE mapping and the supplied tags ('Information Disclosure', 'Linux') do not match the observed impact class, since the vector sets C:N/I:N with only A:H. The CPE data (cpe:2.3:a:linux:linux) confirms this is the upstream Linux kernel rather than a downstream distribution-specific package, and the referenced git.kernel.org stable commits identify the fix as a targeted check for the critical scenario in the scheduler/state-change interaction, i.e. a small hardening patch rather than an architectural rewrite. Exploitation requires a vulnerable kernel with MPTCP compiled in and actively negotiating multiple subflows; the race is reachable by a remote MPTCP-capable peer but is inherently probabilistic.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.9 MEDIUM

Network-reachable MPTCP path so AV:N/PR:N, but exploitation depends on winning a narrow scheduler-vs-state-change race so AC:H; only a crash results, hence C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Sep 25, 2026 - 11:02 EUVD
CVE Published
Sep 25, 2026 - 10:21 cve.org
HIGH 7.5
CVE Published
Sep 25, 2026 - 10:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mptcp: close race between scheduler and state change

The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mss_now reset to 0 for a divide operation.

Address the issue by explicitly checking for the critical scenario.

Executive ViewAI

Why It Matters

A denial-of-service flaw in the Linux kernel's Multipath TCP (MPTCP) implementation allows an unauthenticated remote peer to crash affected hosts, potentially disrupting network availability for organizations relying on multipath connections. Only Linux systems built with CONFIG_MPTCP and configured for multiple subflows are at risk; single-path TCP is unaffected. Although exploitation requires a narrow timing window and no public exploit identified at time of analysis, the availability-only impact on critical infrastructure warrants immediate attention for affected environments.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 53% exploitable
Prevalence
Ubiquitous
Linux kernel networking stack; MPTCP is a built-in but config/usage-gated feature
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97523 ADVISORY https://vuldb.com/vuln/409914 REF https://git.kernel.org/stable/c/0a926b5df8efdfbac07e2fb7fafb21849a2ad9c0 REF https://git.kernel.org/stable/c/42064de57fb83231fcc89663a94885f228a1ee53 REF https://git.kernel.org/stable/c/4c856f3c151a2f3fa237caa651c44015916ca584 REF https://git.kernel.org/stable/c/5883ae880f51edc4b1484e787473b865b6159ead REF https://git.kernel.org/stable/c/8f11430d51ff8365bc51b670bc3002b65ae4c6b7 REF https://git.kernel.org/stable/c/a09c87abf10a0a7e203137c75b5381aa63d9b31d REF https://git.kernel.org/stable/c/d74b2e26b54a7dae1d87c1f19ae0d6db500e5e03

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy