CVE-2026-97568

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. A local attacker could cause a denial of service (DoS) by exploiting an uninitialized memory access during connection handling. When processing connection requests using SYN cookies, the kernel copies uninitialized subflow state information instead of preserving the proper connection flags, leading to kernel instability and potential system crashes.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and primarily results in system instability or denial of service, with no loss of confidentiality or data integrity. The flaw is triggered during Multipath TCP (MPTCP) SYN-cookie handling when copying uninitialized subflow state data. Systems not actively processing MPTCP traffic or where MPTCP is unused are not exposed during standard TCP operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.