CVE-2026-97522 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and deployers should assess exposure and verify patched versions to ensure proper accounting and prevent mismatched push calls. Linux kernel deployments require verification of patched versions to prevent potential issues. This vulnerability affects Linux kernel maintainers, users, and deployers who need to verify patched versions and assess exposure.

Why it matters

A vulnerability in the Linux kernel's mptcp subsystem has been addressed. The issue involves improper accounting in the __mptcp_subflow_push_pending function. Linux kernel maintainers and users should assess exposure and verify patched versions to prevent potential issues.

• Verify patched Linux kernel versions to prevent potential mismatched push calls
• Assess exposure in Linux kernel deployments to ensure proper accounting

Technical summary

The Linux kernel's mptcp subsystem has a vulnerability in the __mptcp_subflow_push_pending function. If __subflow_push_pending errors out, the function should avoid updating copied byte counters to prevent mismatched push calls. This vulnerability affects Linux kernel deployments and requires verification of patched versions to ensure proper accounting and prevent mismatched push calls. Linux kernel maintainers and users should assess exposure and verify patched versions to prevent potential issues. The vulnerability involves improper accounting, which could lead to mismatched push calls.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patched versions.

Recommended defensive actions

• Review Linux kernel versions for patch inclusion
• Verify __mptcp_subflow_push_pending function updates
• Assess exposure in Linux kernel deployments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification of affected versions and exploitation is required. The vulnerability involves improper accounting in the __mptcp_subflow_push_pending function, which could lead to mismatched push calls if __subflow_push_pending errors out. Linux kernel maintainers and users should verify patched versions and assess exposure to ensure proper accounting.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.