CVE-2026-97522: mptcp: fix bad accounting in __mptcp_subflow_push_pending()
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix bad accounting in mptcpsubflowpushpending()
If subflowpushpending() errors out we should avoid updating the copied byte counters, to avoid mismatch push call later on.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What systems are potentially affected?
Systems running the Linux kernel with MPTCP functionality in use are potentially affected. The issue is in the MPTCP subflow pending-data push path.
What condition triggers the accounting mismatch?
The mismatch can occur when __subflow_push_pending() returns an error. In that case, copied-byte counters may be updated even though the push operation did not complete successfully.
How can I determine whether a kernel includes the fix?
Check whether the kernel source or stable maintenance history includes one of the referenced fixes: 9781fa35d9f7a87a83115acd3a88bc9ce35b5407, a0a64525f3414268ed4b1945a1dc690aa974dd4f, or dc054821e639a2e14f1419436612db70b6af45fc.