CVE-2026-97566

A flaw was found in the Linux kernel. When removing an initial endpoint in the Multipath TCP (MPTCP) path manager, the system fails to clear pending address announcements, leaving stale entries in memory. A local user can exploit this vulnerability by manipulating MPTCP endpoint configurations, which may trigger a kernel warning or lead to a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel's Multipath TCP (MPTCP) in-kernel path manager. When the initial (ID 0) endpoint is removed, the removal path fails to tear down pending ADD_ADDR announcements, leaving a stale announcement list entry in memory. When the path manager later re-selects ID 0 after another signal endpoint is added, it finds the stale entry and hits a WARN_ON_ONCE assertion in mptcp_pm_announced_alloc(). A local user able to manipulate MPTCP endpoint configuration (which requires CAP_NET_ADMIN privileges) could exploit this flaw to trigger a kernel warning and, on systems configured with panic_on_warn, a kernel panic, resulting in a local denial of service. No memory corruption or privilege escalation path is demonstrated by the fix. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; for these products the fix is deferred to a future regularly scheduled kernel update because the issue is limited to a local denial of service by an already-privileged user, so the residual risk is confined to that low-impact scenario. Earlier Red Hat Enterprise Linux versions (6, 7, 8, and 9, including kernel-rt) and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present in those kernels. Although the Red Hat CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the overall severity of this flaw as Low because triggering the flaw requires local privileged access to the MPTCP control plane rather than being network reachable, and the typical consequence is a kernel warning with only a potential denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.