CVE-2026-97524 mptcp: avoid unneeded actions on subflow reset
A recursion loop in the Linux kernel MPTCP receive path can cause excessive processing and resource consumption, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97524?
CVE-2026-97524 is a high-severity denial of service vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: avoid unneeded actions on subflow reset
Once in a blue moon, the mptcp receive path can recursively call mptcp_data_ready() via state change under unlucky error conditions, and then try to hold the data lock again.
Break the recursion loop explicitly checking for the exceptional condition.
Add a new flag instead of using an existing one like 'closing', to exit early in subflow_state_change(), and explicitly flush the RX queue at reset time.
This avoids unneeded processing to check for available data -- calling get_mapping_status() and more on a dying subflow -- but also in error reporting and worker scheduling.
Note that we must consume the currently peeked skb before invoking mptcp_dss_corruption to avoid consuming it again after the eventual reset has freed it.
Which versions are affected by CVE-2026-97524?
How do I fix CVE-2026-97524?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97524 being exploited?
There is no known exploitation of CVE-2026-97524 in the wild and no public exploit code.
Sources
Also known as AZL-104583, BELL-CVE-2026-97524, DEBIAN-CVE-2026-97524, GHSA-wphv-p3gw-h29j, UBUNTU-CVE-2026-97524.