HIGH
mptcp PushRelease Race
CVE-2026-97523
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: close race between scheduler and state change The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mss_now reset to 0 for a divide operation. Address the issue by explicitly checking for the critical scenario.
02KernelScan AI Analysis
Risk summary
A race between the MPTCP scheduler and subflow state changes can reset a socket's maximum segment size to zero, causing a divide-by-zero kernel panic during data transmission. Any remote MPTCP peer or unprivileged local user with access to MPTCP sockets can trigger this crash.
Vulnerability analysis
The MPTCP packet scheduler can race with subflow socket state changes, allowing a transmission attempt to proceed after the socket's maximum segment size has been reset to zero during a close or fallback transition. When the kernel then divides by that zero value, a fault occurs and the system crashes. The fix adds a guard that skips the transmission step when the segment size is zero, preventing the crash without altering the scheduling logic itself. The flaw is reachable by any remote peer that exchanges MPTCP traffic with the target, as well as by any local user who can create MPTCP sockets.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15.190 | 5.15.222 | d74b2e26b54a |
| 5.19 | 5.19.4 | 5.20 | 5883ae880f51 |
| 6.1 | — | 6.1.189 | 0a926b5df8ef |
| 6.12 | — | 6.12.111 | a09c87abf10a |
| 6.18 | — | 6.18.53 | 4c856f3c151a |
| 6.6 | — | 6.6.158 | 8f11430d51ff |
| 7.2 | — | 7.2.7 | 42064de57fb8 |
| mainline | — | 7.3 | — |
| cip/5.10 | — | 5.10.271-cip78 | 2f8c4d57b312 |
| cip/6.1 | — | 6.1.189-cip61 | 5883ae880f51 |
| cip/6.1-rt | — | 6.1.189-cip61-rt32 | 5883ae880f51 |
| cip/6.12 | — | 6.12.111-cip32 | 8f11430d51ff |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |