CVE-2026-97524

A flaw was found in the Linux kernel's MultiPath TCP (MPTCP) subsystem. Under specific network error and subflow reset conditions during data receive operations, the kernel can enter a recursive call loop that attempts to acquire an already-held data lock. A remote attacker communicating over an MPTCP connection could trigger these conditions to cause a kernel deadlock, resulting in a system freeze and a Denial of Service (DoS).

An MPTCP subflow reset can recursively reenter the receive path through a state change and attempt to acquire the data lock again under rare error conditions. A malformed or corrupted DSS mapping from a remote MPTCP peer can also cause reset processing to purge the receive queue while the current skb is still being processed, creating a plausible use after free or double free condition. For the CVSS the PR:N because the remote peer does not need local access or elevated privileges beyond the ability to establish or interact with an affected MPTCP connection. The issue is network reachable where MPTCP is enabled and exposed to untrusted peers. Impact is at least denial of service through a lockup or kernel crash. In the paranoid case confidentiality and integrity impact are rated High because the skb lifetime error is a plausible memory corruption candidate and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.