CVE-2026-97568mptcp: syncookies: remember the request backup flag
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: syncookies: remember the request backup flag Instead of using an uninitialised bit when copying the info in subflow_ulp_clone(). To fix this, no need to extend the join_entry structure: backup is coming from struct mptcp_subflow_request_sock, only one bit. Do the same here by using one bit for both.
Timeline
ID reserved
By Linux
- 1 day later
· 1 day later
Published
- 24 days later
· 24 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 88% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 1008f2bcbc8e461c1df3aebba30ac4f616ebe570 – < c97fa2c7ada82d4cac1c6c00643238dc4c462f15
- affected 6f01f41b6a492ddf2da7609967cfaf57e7ca48a7 – < 1668b34452009d27be3262646de748a3e48ffd51
- affected 09176f80995105c62939728fbad5c437d61e7ff4 – < b138e7dc719f0a3949de8bb6500b8cf1604eea06
- affected 8ed3e34c766e8264d5d2e0436f86c51604d6a8a7 – < 360d99258a6402cb8e49771460944f19f04d25b7
- affected efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 – < 61178d0b85b4b1b53e78b06e89d018d22d102f88
- affected efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 – < 00b2bd518911e0daab00f4749cce68c191ccebb4
- affected efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 – < 06d649f9cd03a9f8e768a658b20acf8d2c8022e0
- affected efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 – < b76c0e28b392620dfbaf92cdeedbf115820b44cb
- affected 73e2baa301ee3f62ff971e68877adeb37f98cc67
- affected 5.10.224 – < 5.10.271
- affected 5.15.165 – < 5.15.222
- affected 6.1.104 – < 6.1.189
- affected 6.6.45 – < 6.6.158
- affected 6.10.4 – < 6.11
- affected 6.11
- unaffected < 6.11
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.111 – ≤ 6.12.*
- unaffected 6.18.53 – ≤ 6.18.*
- unaffected 7.2.7 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/c97fa2c7ada82d4cac1c6c00643238dc4c462f15 (opens in a new tab)
- https://git.kernel.org/stable/c/1668b34452009d27be3262646de748a3e48ffd51 (opens in a new tab)
- https://git.kernel.org/stable/c/b138e7dc719f0a3949de8bb6500b8cf1604eea06 (opens in a new tab)
- https://git.kernel.org/stable/c/360d99258a6402cb8e49771460944f19f04d25b7 (opens in a new tab)
- https://git.kernel.org/stable/c/61178d0b85b4b1b53e78b06e89d018d22d102f88 (opens in a new tab)
- https://git.kernel.org/stable/c/00b2bd518911e0daab00f4749cce68c191ccebb4 (opens in a new tab)
- https://git.kernel.org/stable/c/06d649f9cd03a9f8e768a658b20acf8d2c8022e0 (opens in a new tab)
- https://git.kernel.org/stable/c/b76c0e28b392620dfbaf92cdeedbf115820b44cb (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-86876 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-97568)Record last updated .