{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97567", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.155Z", "datePublished": "2026-09-25T10:21:53.677Z", "dateUpdated": "2026-10-30T12:37:28.529Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:37:28.529Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: prevent race between disconnect() and rtx\n\nSashiko noted that the two event can race, leading to inconsistent\nstatus. Prevent the race using the synchronous timer stop operation."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.c"], "versions": [{"version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "lessThan": "1a68a88369c0ab6309bd17f7e408290c5cb80dcf", "status": "affected", "versionType": "git"}, {"version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "lessThan": "75b3b30ae4ee6aa0572595f6b48544ed4f479eb6", "status": "affected", "versionType": "git"}, {"version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "lessThan": "2261f857ef4e0d21eb1a8b47b06640cf7ab16d3e", "status": "affected", "versionType": "git"}, {"version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "lessThan": "374da2b9be1280695ce41f108334a8f16e3e54be", "status": "affected", "versionType": "git"}, {"version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "lessThan": "69a7b2a912672159dda7dcf325d27752d448dfdf", "status": "affected", "versionType": "git"}, {"version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "lessThan": "85c580b0d8590520ae00a15c29e9fb9c99427a3e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1a68a88369c0ab6309bd17f7e408290c5cb80dcf"}, {"url": "https://git.kernel.org/stable/c/75b3b30ae4ee6aa0572595f6b48544ed4f479eb6"}, {"url": "https://git.kernel.org/stable/c/2261f857ef4e0d21eb1a8b47b06640cf7ab16d3e"}, {"url": "https://git.kernel.org/stable/c/374da2b9be1280695ce41f108334a8f16e3e54be"}, {"url": "https://git.kernel.org/stable/c/69a7b2a912672159dda7dcf325d27752d448dfdf"}, {"url": "https://git.kernel.org/stable/c/85c580b0d8590520ae00a15c29e9fb9c99427a3e"}], "title": "mptcp: prevent race between disconnect() and rtx", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mptcp/protocol.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1a68a88369c0ab6309bd17f7e408290c5cb80dcf", "status": "affected", "version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "versionType": "git"}, {"lessThan": "75b3b30ae4ee6aa0572595f6b48544ed4f479eb6", "status": "affected", "version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "versionType": "git"}, {"lessThan": "2261f857ef4e0d21eb1a8b47b06640cf7ab16d3e", "status": "affected", "version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "versionType": "git"}, {"lessThan": "374da2b9be1280695ce41f108334a8f16e3e54be", "status": "affected", "version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "versionType": "git"}, {"lessThan": "69a7b2a912672159dda7dcf325d27752d448dfdf", "status": "affected", "version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "versionType": "git"}, {"lessThan": "85c580b0d8590520ae00a15c29e9fb9c99427a3e", "status": "affected", "version": "b29fcfb54cd70caca5b11c80d8d238854938884a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mptcp/protocol.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: prevent race between disconnect() and rtx\n\nSashiko noted that the two event can race, leading to inconsistent\nstatus. Prevent the race using the synchronous timer stop operation."}], "id": "CVE-2026-97567", "lastModified": "2026-10-30T13:21:08.600", "metrics": {}, "published": "2026-09-25T11:17:07.343", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1a68a88369c0ab6309bd17f7e408290c5cb80dcf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2261f857ef4e0d21eb1a8b47b06640cf7ab16d3e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/374da2b9be1280695ce41f108334a8f16e3e54be"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/69a7b2a912672159dda7dcf325d27752d448dfdf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/75b3b30ae4ee6aa0572595f6b48544ed4f479eb6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/85c580b0d8590520ae00a15c29e9fb9c99427a3e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mptcp: prevent race between disconnect() and rtx", "id": "2541009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541009"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmptcp: prevent race between disconnect() and rtx\nSashiko noted that the two event can race, leading to inconsistent\nstatus. Prevent the race using the synchronous timer stop operation.", "A flaw was found in the Linux kernel's MultiPath TCP (MPTCP) subsystem. A race condition can occur between socket disconnection and packet retransmission timer handling, resulting in an inconsistent socket state. A local user can exploit this timing flaw during active connection teardown to cause a system crash, leading to a Denial of Service (DoS)."], "name": "CVE-2026-97567", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97567\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97567\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97567.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b29fcfb54cd70caca5b11c80d8d238854938884a,374da2b9be1280695ce41f108334a8f16e3e54be)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b29fcfb54cd70caca5b11c80d8d238854938884a,69a7b2a912672159dda7dcf325d27752d448dfdf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b29fcfb54cd70caca5b11c80d8d238854938884a,85c580b0d8590520ae00a15c29e9fb9c99427a3e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T13:15:07.880182+00:00", "updated": "2026-10-01T13:45:06.659237+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}