Skip to main content

Linux Kernel EUVDEUVD-2026-86832

| CVE-2026-97524 HIGH
2026-09-25 Linux GHSA-wphv-p3gw-h29j
Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Establish MPTCP connection with subflows
  2. Delivery
    Induce subflow error/reset condition
  3. Exploit
    Trigger recursive mptcp_data_ready() re-entry
  4. Execution
    Kernel re-acquires data lock / recursion loop
  5. Impact
    Connection processing hang or crash (DoS)

Vulnerability Assessment

Exploitation Conditions

Requires the Multipath TCP (MPTCP) subsystem to be in use, with an established MPTCP connection carrying subflows that then hit an error/reset condition - the recursion into mptcp_data_ready() only occurs on a dying subflow during reset under exceptional error handling. Exploitation is strongly limited by the rarity of the timing window (described as happening 'once in a blue moon'), meaning an attacker cannot deterministically trigger it; systems not using MPTCP are unaffected regardless of kernel version.
Impact

This is a robustness/reliability bug in the Linux kernel MPTCP (Multipath TCP) receive path, not a security-priority issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a pure availability impact with no confidentiality or integrity effect. However, the AC:L rating conflicts with the description, which states the recursion into mptcp_data_ready() (and re-acquiring the data lock) happens 'once in a blue moon' under 'unlucky error conditions' - that is a rare, timing-dependent race, better modeled as AC:H. There is no EPSS score, no CISA KEV listing, and no public exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The condition is an internal recursion triggered by subflow state changes during error/reset handling rather than a directly attacker-crafted input, so treating this as remotely weaponizable would overstate real-world risk. Net: high CVSS but low real-world priority - a stability hardening fix rather than a targeted-attack vector.
Exploit ScenarioDerived

Under rare error conditions during MPTCP subflow reset, the kernel receive path recursively re-enters mptcp_data_ready() while already holding the data lock, causing a lock re-entry/recursion loop that can hang or crash the connection processing (denial of service). No public exploit exists, and reliably forcing the 'once in a blue moon' timing window remotely is impractical, so a realistic trigger is adverse network/error timing on a system with MPTCP subflows active rather than a crafted single-shot payload.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Denial of service in the Linux kernel's Multipath TCP (MPTCP) receive path can occur when a subflow is reset during exceptional error handling, letting the receive path recursively re-enter mptcp_data_ready() and attempt to take the data lock a second time. The defect affects MPTCP-enabled kernels across several stable branches prior to fixes released in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc4, and only hosts that actually run MPTCP connections carrying subflows are exposed; the traffic is reachable unauthenticated from the network (CVSS PR:N), but the triggering window is exceptionally rare and not deterministically reachable, which is why attack complexity is assessed as High. No public exploit identified at time of analysis and there is no confirmed active exploitation; the authoritative assessment classifies this as a robustness/reliability bug rather than a security-priority issue.

RemediationAI

Vendor-released patch: apply the upstream MPTCP fix available in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc4, or pull the corresponding stable backport commits 2b0f561f21b27c40c91ea4975268a06092bd7e9c, 4b7abdcb5ba832fafab679f0d998af39cbc99307, b2dbcc1ed48b5ac070a41db4a52aade6823c4df0 and ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f from git.kernel.org as referenced in the CVE record and https://nvd.nist.gov/vuln/detail/CVE-2026-97524; normal distribution kernel maintenance cycles are adequate given there is no confirmed exploitation and triggering is non-deterministic. As a compensating control, hosts that do not rely on Multipath TCP can disable it for new connections via the net.mptcp.enabled sysctl (set it to 0) or by ensuring the MPTCP Kconfig option is not enabled in custom kernel builds - the trade-off is loss of MPTCP multipath functionality for applications that request IPPROTO_MPTCP sockets, including any multipath failover or aggregation they depend on. Because the affected code is reached only through an established MPTCP connection with subflows, network filtering is not an effective blanket mitigation, though restricting who can establish MPTCP connections to trusted peers reduces the pool of potential triggers at the cost of limiting legitimate multipath clients. Apply the patch as part of routine kernel updates rather than emergency response, and re-enable MPTCP if it was disabled once the fixed kernel is deployed.

Affected VersionsENISA

Linux 12c1676d598e3b8dd92a033b623b792cc2ea1ec5
Linux patch: 6.12.111
Linux patch: 7.2.7
Linux 8bfd391bde685df7289b928ce8876a3583be4bfb
Linux 35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25
Linux fde99e972b8f88cebe619241d7aa43d288ef666a
Linux 6.6.57 <6.7
Linux patch: 0
Linux 6.1.113 <6.2
Linux e32d262c89e2b22cb0640223f953b548617ed8a6 <2b0f561f21b27c40c91ea4975268a06092bd7e9c
Linux e32d262c89e2b22cb0640223f953b548617ed8a6 <ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f
Linux b8be15d1ae7ea4eedd547c3b3141f592fbddcd30
Linux 6.11.4 <6.12
Linux 5.15.169 <5.16
Linux patch: 6.18.53
Linux patch: 7.3-rc4
Linux 6.12
Linux e32d262c89e2b22cb0640223f953b548617ed8a6 <4b7abdcb5ba832fafab679f0d998af39cbc99307
Linux 5.10.228 <5.11
Linux e32d262c89e2b22cb0640223f953b548617ed8a6 <b2dbcc1ed48b5ac070a41db4a52aade6823c4df0

Affected Packages

euvd linux fix: 5.11, 5.16, 6.2, 6.7, 6.12

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

MPTCP is the Linux kernel subsystem that lets a single TCP connection span multiple network paths by managing multiple 'subflows' under one logical connection; the MPTCP-level receive path (mptcp_data_ready(), get_mapping_status(), the data lock, and worker scheduling) processes data delivered by those subflows. The bug is a re-entrancy/recursion condition: under unlucky error conditions, a state change on a dying subflow causes the receive path to call mptcp_data_ready() recursively and then try to hold the MPTCP data lock again, performing unnecessary work on a subflow that is already being reset. The upstream fix breaks the recursion by introducing a new dedicated flag (deliberately not reusing an existing state such as 'closing') so that subflow_state_change() exits early, and by explicitly flushing the RX queue at reset time; it also ensures the currently peeked skb is consumed before mptcp_dss_corruption is invoked, so that the skb is not consumed again after the reset has freed it. This last point is an ordering/lifetime concern within the same reset path rather than an independently demonstrated memory-safety impact. No CWE is assigned in the source data; the class is best described as uncontrolled recursion and improper handling of a re-entrant receive path on a subflow being torn down. Note that the supplied tags label this 'Information Disclosure', but the assessed vector (C:N/I:N/A:H) indicates availability-only impact, so the tag should be treated as a classification artifact for this CVE.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.9 MEDIUM

Network-reachable MPTCP path (AV:N) with no auth (PR:N), but the recursion requires a rare error/reset timing window (AC:H); impact is availability-only (C:N/I:N/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Sep 25, 2026 - 11:02 EUVD
CVE Published
Sep 25, 2026 - 10:21 cve.org
HIGH 7.5
CVE Published
Sep 25, 2026 - 10:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mptcp: avoid unneeded actions on subflow reset

Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again.

Break the recursion loop explicitly checking for the exceptional condition.

Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time.

This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling.

Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it.

Executive ViewAI

Why It Matters

A denial-of-service flaw in the Linux kernel's Multipath TCP (MPTCP) receive path can cause kernel instability or crashes on systems that actively use MPTCP subflows, potentially disrupting network services and availability for affected workloads. While the vulnerability is network-reachable without authentication, it requires a rare and non-deterministic triggering condition, and no public exploit or active exploitation has been identified. Leadership should prioritize patching for any infrastructure running MPTCP-dependent services, as an unpatched kernel could be forced into a denial-of-service state.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 53% exploitable
Prevalence
Ubiquitous
Linux kernel is ubiquitous, though the flaw is gated on MPTCP being in use
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97524 ADVISORY https://vuldb.com/vuln/409921 REF https://git.kernel.org/stable/c/1962841387087970d75ba8b8d4c2aa2d45705e50 REF https://git.kernel.org/stable/c/2b0f561f21b27c40c91ea4975268a06092bd7e9c REF https://git.kernel.org/stable/c/4b7abdcb5ba832fafab679f0d998af39cbc99307 REF https://git.kernel.org/stable/c/6d669c740933124eae3df8cfc15995af9bcc6aba REF https://git.kernel.org/stable/c/83a7dcdd2b1060484528da70a643125174d47e5a REF https://git.kernel.org/stable/c/a370e56024df0b07e3120c45a9773ae123819fd6 REF https://git.kernel.org/stable/c/b2dbcc1ed48b5ac070a41db4a52aade6823c4df0 REF https://git.kernel.org/stable/c/ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9f

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy