CVE-2026-97568: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: mptcp: syncookies: remember the request backup flag Instead of using an uninitialised bit when copying the info in subflow_ulp_clone(). To fix this, no need to extend the join_entry structure: backup is coming from struct mptcp_subflow_request_sock, only one bit. Do the same here by using one bit for both.

Affected products

• Linux Linux: from 5.10.224, before 5.10.271 (fixed in 5.10.271); from 5.15.165, before 5.15.222 (fixed in 5.15.222); from 6.1.104, before 6.1.189 (fixed in 6.1.189); from 6.6.45, before 6.6.158 (fixed in 6.6.158); from 6.10.4, before 6.11 (fixed in 6.11); from 6.11, before 6.12.111 (fixed in 6.12.111); …

Published 2026-09-25. Last modified 2026-10-03.