CVE-2026-97568: mptcp: syncookies: remember the request backup flag
In the Linux kernel, the following vulnerability has been resolved:
mptcp: syncookies: remember the request backup flag
Instead of using an uninitialised bit when copying the info in subflowulpclone().
To fix this, no need to extend the joinentry structure: backup is coming from struct mptcpsubflowrequestsock, only one bit. Do the same here by using one bit for both.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to be reached?
The affected code is in the Linux kernel's MPTCP syncookie handling and involves copying the backup flag during subflow ULP cloning. The provided information does not specify network reachability requirements, authentication requirements, or a concrete attack scenario.
How can I determine whether a system includes the fix?
Check whether the Linux kernel build includes one of the referenced stable commits: 61178d0b85b4b1b53e78b06e89d018d22d102f88, 00b2bd518911e0daab00f4749cce68c191ccebb4, or 06d649f9cd03a9f8e768a658b20acf8d2c8022e0. The supplied data does not identify affected or fixed kernel version numbers.
What is the mitigation if updating the kernel is not immediately possible?
No mitigation or configuration workaround is provided. The described resolution is a kernel code change that records the request backup flag rather than using an uninitialized bit.