CVE-2026-97567 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel versions affected by CVE-2026-97567 should assess exposure and verify patch deployment. This includes reviewing the vulnerability's impact on Linux kernel deployments and ensuring that patches are applied to prevent potential MPTCP-related issues. Linux kernel maintainers and users should also monitor Linux kernel logs for signs of potential MPTCP-related issues.

Why it matters

CVE-2026-97567 is a race condition vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation. Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential MPTCP-related issues.

• Verify patch deployment for Linux kernel versions affected by CVE-2026-97567 to prevent potential MPTCP-related issues
• Monitor Linux kernel logs for signs of potential MPTCP-related issues
• Assess exposure of Linux kernel deployments to CVE-2026-97567

Technical summary

The Linux kernel's Multipath TCP (MPTCP) implementation has a race condition vulnerability between disconnect() and rtx events, leading to inconsistent status. A synchronous timer stop operation has been implemented to prevent the race. This vulnerability affects Linux kernel versions and could lead to potential MPTCP-related problems if not addressed. The technical details of the vulnerability involve a race condition that can cause inconsistent status in MPTCP implementations. The fix involves a synchronous timer stop operation to prevent the race.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patch deployment.

Recommended defensive actions

• Assess exposure of Linux kernel deployments to CVE-2026-97567
• Verify patch deployment for Linux kernel versions affected by CVE-2026-97567
• Monitor Linux kernel logs for signs of potential MPTCP-related issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Linux kernel patch notes indicate a race condition between disconnect() and rtx events. Further verification is needed to assess exposure and ensure patch deployment. The vulnerability was resolved with a synchronous timer stop operation. Evidence from the Linux kernel patch notes and CVE record suggests that this issue could lead to inconsistent status if not addressed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.