CVE-2026-97568 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
mptcp: syncookies: remember the request backup flag
Instead of using an uninitialised bit when copying the info in subflow_ulp_clone().
To fix this, no need to extend the join_entry structure: backup is coming from struct mptcp_subflow_request_sock, only one bit. Do the same here by using one bit for both.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's implementation of Multipath TCP (MPTCP) contains a critical flaw within its SYN cookie generation and validation logic that stems from improper handling of uninitialized memory bits during subflow cloning operations. MPTCP is designed to allow connections to use multiple paths simultaneously, enhancing throughput and resilience by aggregating bandwidth across different network interfaces or routes. A core component of this architecture involves the management of subflows, which are individual TCP streams that make up a single logical MPTCP connection. When establishing these subflows, particularly during the initial handshake phase where SYN cookies are employed to mitigate denial-of-service attacks, the kernel must accurately preserve and transfer specific state flags between data structures representing the request socket and the established connection entry.
The vulnerability arises in the function responsible for cloning user space protocol information, specifically within the context of handling incoming SYN packets that trigger the creation of a backup subflow. The code previously attempted to copy information into the join_entry structure by referencing an uninitialized bit field. This means that instead of explicitly setting or copying the specific flag indicating whether this subflow is intended as a backup path, the kernel was inadvertently carrying over whatever garbage data happened to reside in that memory location at runtime. Because C does not guarantee zero-initialization of all stack variables unless explicitly done, this results in non-deterministic behavior where the system cannot reliably distinguish between a primary and a backup subflow based on this flag alone during critical handshake phases.
This lack of initialization leads to significant operational instability within MPTCP connections. If the uninitialized bit is interpreted as set when it should be clear, or vice versa, the kernel may incorrectly assign roles to network paths. This can result in traffic being routed over a backup path that was not intended for primary data transmission, leading to suboptimal performance, increased latency, and potential packet loss due to out-of-order delivery issues inherent in multipath routing if state is misaligned. In more severe scenarios, particularly under high load or specific race conditions during connection establishment, this inconsistency can cause the MPTCP stack to enter an invalid state, potentially leading to connection drops or, theoretically, further exploitation vectors where an attacker might manipulate network timing to exploit the ambiguity in subflow roles for denial-of-service purposes.
The resolution involves a precise correction to how the backup flag is handled during the cloning process. Rather than extending the join_entry structure with additional fields which would increase memory overhead and complexity, the fix ensures that both the source struct mptcp_subflow_request_sock and the destination use exactly one bit for this purpose. By explicitly copying only this single relevant bit from the request socket to the new entry, the kernel guarantees deterministic behavior. This approach maintains backward compatibility with existing data structures while eliminating the risk of reading uninitialized memory. It aligns the internal state representation with the actual intent of the connection setup procedure, ensuring that backup subflows are correctly identified and managed according to MPTCP specifications.
From a security architecture perspective, this issue is classified under CWE-457, which describes the use of an uninitialized variable. While it does not directly allow for arbitrary code execution or privilege escalation in its current form, it represents a fundamental integrity failure within the protocol stack's state management. The vulnerability falls under MITRE ATT&CK technique T1498, Network Denial of Service, specifically regarding resource exhaustion through connection manipulation, as an attacker could potentially trigger repeated failed handshake attempts that rely on this flawed logic to disrupt service availability for legitimate users. Mitigation requires applying the kernel patch that corrects the bit copying mechanism in the MPTCP subflow handling code. System administrators should ensure their Linux kernels are updated to versions where this specific fix is included, thereby restoring reliable multipath functionality and preventing potential instability or denial-of-service conditions arising from uninitialized state flags during connection establishment.