{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97522", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.152Z", "datePublished": "2026-09-25T10:21:26.420Z", "dateUpdated": "2026-10-19T09:08:40.383Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:08:40.383Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix bad accounting in __mptcp_subflow_push_pending()\n\nIf __subflow_push_pending() errors out we should avoid updating the\ncopied byte counters, to avoid mismatch push call later on."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.c"], "versions": [{"version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "lessThan": "ddbf9f03c1cc7d5b86eebe7c2beea0db4286d354", "status": "affected", "versionType": "git"}, {"version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "lessThan": "9781fa35d9f7a87a83115acd3a88bc9ce35b5407", "status": "affected", "versionType": "git"}, {"version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "lessThan": "a0a64525f3414268ed4b1945a1dc690aa974dd4f", "status": "affected", "versionType": "git"}, {"version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "lessThan": "dc054821e639a2e14f1419436612db70b6af45fc", "status": "affected", "versionType": "git"}, {"version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "lessThan": "f3ef03357396d4b147d8e76c75fb612c2f264ffc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ddbf9f03c1cc7d5b86eebe7c2beea0db4286d354"}, {"url": "https://git.kernel.org/stable/c/9781fa35d9f7a87a83115acd3a88bc9ce35b5407"}, {"url": "https://git.kernel.org/stable/c/a0a64525f3414268ed4b1945a1dc690aa974dd4f"}, {"url": "https://git.kernel.org/stable/c/dc054821e639a2e14f1419436612db70b6af45fc"}, {"url": "https://git.kernel.org/stable/c/f3ef03357396d4b147d8e76c75fb612c2f264ffc"}], "title": "mptcp: fix bad accounting in __mptcp_subflow_push_pending()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mptcp/protocol.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ddbf9f03c1cc7d5b86eebe7c2beea0db4286d354", "status": "affected", "version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "versionType": "git"}, {"lessThan": "9781fa35d9f7a87a83115acd3a88bc9ce35b5407", "status": "affected", "version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "versionType": "git"}, {"lessThan": "a0a64525f3414268ed4b1945a1dc690aa974dd4f", "status": "affected", "version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "versionType": "git"}, {"lessThan": "dc054821e639a2e14f1419436612db70b6af45fc", "status": "affected", "version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "versionType": "git"}, {"lessThan": "f3ef03357396d4b147d8e76c75fb612c2f264ffc", "status": "affected", "version": "0fa1b3783a17d75a4aa1651a18ede041ffca5750", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mptcp/protocol.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix bad accounting in __mptcp_subflow_push_pending()\n\nIf __subflow_push_pending() errors out we should avoid updating the\ncopied byte counters, to avoid mismatch push call later on."}], "id": "CVE-2026-97522", "lastModified": "2026-10-19T10:17:21.023", "metrics": {}, "published": "2026-09-25T11:17:02.297", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9781fa35d9f7a87a83115acd3a88bc9ce35b5407"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a0a64525f3414268ed4b1945a1dc690aa974dd4f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc054821e639a2e14f1419436612db70b6af45fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddbf9f03c1cc7d5b86eebe7c2beea0db4286d354"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f3ef03357396d4b147d8e76c75fb612c2f264ffc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mptcp: fix bad accounting in __mptcp_subflow_push_pending()", "id": "2541176", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541176"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-252", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmptcp: fix bad accounting in __mptcp_subflow_push_pending()\nIf __subflow_push_pending() errors out we should avoid updating the\ncopied byte counters, to avoid mismatch push call later on.", "A flaw was found in the Linux kernel's MultiPath TCP (MPTCP) subsystem. When an error occurs while pushing pending data across subflows, the kernel improperly updates the transmitted byte counter with a negative error code instead of only accounting for successful transmissions. This accounting mismatch can cause subsequent push operations to fail and corrupt connection state, potentially resulting in a Denial of Service (DoS)."], "name": "CVE-2026-97522", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97522\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97522\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97522.mbox"], "threat_severity": "Low"}