CVE-2026-97522: mptcp: fix bad accounting in __mptcp_subflow_push_pending()
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix bad accounting in mptcpsubflowpushpending()
If subflowpushpending() errors out we should avoid updating the copied byte counters, to avoid mismatch push call later on.
Affected Software
Event History
Frequently Asked Questions
What systems are potentially affected?
Systems running the Linux kernel with MPTCP functionality in use are potentially affected. The issue is in the MPTCP subflow pending-data push path.
What condition triggers the accounting mismatch?
The mismatch can occur when __subflow_push_pending() returns an error. In that case, copied-byte counters may be updated even though the push operation did not complete successfully.
How can I determine whether a kernel includes the fix?
Check whether the kernel source or stable maintenance history includes one of the referenced fixes: 9781fa35d9f7a87a83115acd3a88bc9ce35b5407, a0a64525f3414268ed4b1945a1dc690aa974dd4f, or dc054821e639a2e14f1419436612db70b6af45fc.