UBUNTU-CVE-2026-97566: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not tear down pending announcements, unlike the non-zero id path. When the PM later reselects id 0 after adding another signal endpoint, it finds the stale annolist entry and hits WARNONONCE(mptcppmiskernel()) in mptcppmannouncedalloc(). Root cause: asymmetry between removal paths. - Non-zero id path: mptcpnlremovesubflowandsignaladdr() calls mptcppmremoveannounced() to clean up. - Id 0 path: mptcpnlremoveidzeroaddress() skips cleanup entirely. Fix by making the id 0 path symmetric: call mptcppmannouncedremove() and decrement addaddrsignaled before queuing the RMADDR. Subtle detail: signal endpoints are stored in annolist with port 0, but msklocal carries the connection's local port. In other words, entries linked to ID0 paths should have port == 0. A follow-up patch will ensure that. mptcppmannouncedremove() uses useport=true for comparison. So clear the port before the lookup.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using an affected Ubuntu Linux kernel package and the in-kernel MPTCP path manager are exposed. The listed packages include ubuntu/linux, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-gkeop, and ubuntu/linux-riscv.
What condition triggers the warning?
The condition occurs when the id 0 MPTCP endpoint is removed while a pending ADD_ADDR announcement remains in the kernel path manager's announcement list. If another signal endpoint is added and the path manager later reselects id 0, the stale entry can trigger WARN_ON_ONCE in mptcp_pm_announced_alloc().
Does exploitation require remote access or user interaction?
The supplied vector indicates local access, low attack complexity, low privileges, and no user interaction. The impact is limited to availability; confidentiality and integrity impacts are listed as none.
How can administrators identify a likely affected condition?
A likely symptom is a WARN_ON_ONCE associated with mptcp_pm_announced_alloc() after removing the id 0 endpoint and subsequently adding or selecting another signal endpoint. The stale pending ADD_ADDR announcement for id 0 is the underlying condition.