CVE-2026-97567

A flaw was found in the Linux kernel's MultiPath TCP (MPTCP) subsystem. A race condition can occur between socket disconnection and packet retransmission timer handling, resulting in an inconsistent socket state. A local user can exploit this timing flaw during active connection teardown to cause a system crash, leading to a Denial of Service (DoS).

A race condition flaw, rated Moderate by Red Hat Product Security, was found in the Linux kernel's MultiPath TCP (MPTCP) implementation. The MPTCP socket disconnect() operation and the retransmission (rtx) timer handling can race because the timer was not stopped synchronously during disconnect, which can leave the socket in an inconsistent state. A local user able to create and disconnect MPTCP sockets could trigger this race during active connection teardown, causing a system crash and resulting in a denial of service. The flaw does not affect confidentiality or integrity.

The vulnerable full MPTCP disconnect implementation was introduced upstream in Linux 5.17 and is present in Red Hat Enterprise Linux 9 and later based kernels. Red Hat Enterprise Linux 6, 7, and 8 (including their real-time kernel variants) and OpenShift Container Platform 4.12 (RHEL CoreOS 8) are not affected because the vulnerable code is not present in those kernels. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.13 and later releases based on RHEL CoreOS 9 are affected.

The fix for the affected products has been deferred to a future update. The residual risk is limited: exploitation requires local access to an MPTCP socket, depends on the timing between the disconnect operation and the retransmission timer callback, and the worst case is a system crash (local denial of service) with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.