Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-97524

mptcp: avoid unneeded actions on subflow reset

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again. Break the recursion loop explicitly checking for the exceptional condition. Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time. This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling. Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • fde99e972b8f88cebe619241d7aa43d288ef666a to < 6d669c740933124eae3df8cfc15995af9bcc6abaaffected
  • 12c1676d598e3b8dd92a033b623b792cc2ea1ec5 to < 83a7dcdd2b1060484528da70a643125174d47e5aaffected
  • 35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25 to < a370e56024df0b07e3120c45a9773ae123819fd6affected
  • b8be15d1ae7ea4eedd547c3b3141f592fbddcd30 to < 1962841387087970d75ba8b8d4c2aa2d45705e50affected
  • e32d262c89e2b22cb0640223f953b548617ed8a6 to < 4b7abdcb5ba832fafab679f0d998af39cbc99307affected
  • e32d262c89e2b22cb0640223f953b548617ed8a6 to < b2dbcc1ed48b5ac070a41db4a52aade6823c4df0affected
  • e32d262c89e2b22cb0640223f953b548617ed8a6 to < ce7e4ede01ed3e47a48c0f1ce1d87bf4864bee9faffected
  • e32d262c89e2b22cb0640223f953b548617ed8a6 to < 2b0f561f21b27c40c91ea4975268a06092bd7e9caffected
  • 8bfd391bde685df7289b928ce8876a3583be4bfbaffected
  • 5.10.228 to < 5.10.271affected
  • 5.15.169 to < 5.15.222affected
  • 6.1.113 to < 6.1.189affected
  • 6.6.57 to < 6.6.158affected
  • 6.11.4 to < 6.12affected

Linux Linux

Default version status: affected

  • 6.12affected
  • 0 to < 6.12unaffected
  • 5.10.271 to ≤ 5.10.*unaffected
  • 5.15.222 to ≤ 5.15.*unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References