CVE-2026-97568 PUBLISHED

mptcp: syncookies: remember the request backup flag

Assigner: Linux
Reserved: 24.09.2026 Published: 25.09.2026 Updated: 25.09.2026

In the Linux kernel, the following vulnerability has been resolved:

mptcp: syncookies: remember the request backup flag

Instead of using an uninitialised bit when copying the info in subflow_ulp_clone().

To fix this, no need to extend the join_entry structure: backup is coming from struct mptcp_subflow_request_sock, only one bit. Do the same here by using one bit for both.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 to 61178d0b85b4b1b53e78b06e89d018d22d102f88 (excl.)
  • affected from efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 to 00b2bd518911e0daab00f4749cce68c191ccebb4 (excl.)
  • affected from efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 to 06d649f9cd03a9f8e768a658b20acf8d2c8022e0 (excl.)
  • affected from efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 to b76c0e28b392620dfbaf92cdeedbf115820b44cb (excl.)
  • Version 1008f2bcbc8e461c1df3aebba30ac4f616ebe570 is affected
  • Version 6f01f41b6a492ddf2da7609967cfaf57e7ca48a7 is affected
  • Version 09176f80995105c62939728fbad5c437d61e7ff4 is affected
  • Version 8ed3e34c766e8264d5d2e0436f86c51604d6a8a7 is affected
  • Version 73e2baa301ee3f62ff971e68877adeb37f98cc67 is affected
  • affected from 5.10.224 to 5.11 (excl.)
  • affected from 5.15.165 to 5.16 (excl.)
  • affected from 6.1.104 to 6.2 (excl.)
  • affected from 6.6.45 to 6.7 (excl.)
  • affected from 6.10.4 to 6.11 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.11 is affected
  • unaffected from 0 to 6.11 (excl.)
  • unaffected from 6.12.111 to 6.12.* (incl.)
  • unaffected from 6.18.53 to 6.18.* (incl.)
  • unaffected from 7.2.7 to 7.2.* (incl.)
  • unaffected from 7.3-rc3 to * (incl.)

References