CVE-2026-97522

The Linux kernel bug involves incorrect accounting in the MPTCP subflow push path. When the __mptcp_subflow_push_pending() function fails, the code mistakenly updates byte counters, resulting in mismatched accounting values that can corrupt traffic metrics and potentially lead to unreliable data transmission. This flaw falls under improper handling of counters and is related to CWE-252. The likely attack vector is local to the kernel, as inferred from the description.

Linux kernel versions prior to the patch containing the commit identified in multiple kernel stable branches are affected. The vulnerability is present in all mainstream distributions that ship the unpatched kernel, regardless of vendor, as the issue is in the Linux kernel source itself. Based on the commit references, the affected kernels are inferred to be all releases before the patch.

Because the defect occurs during subflow management, it is only exploitable within a system running the affected kernel; remote exploitation is unlikely. The CVSS score is 5.5 and the EPSS score is < 1%, indicating a low probability of exploitation. The flaw does not grant arbitrary code execution but can degrade data integrity and potentially disrupt MPTCP connections. As the bug is purely internal bookkeeping, the risk is primarily integrity and availability of MPTCP traffic. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local to the kernel and requires kernel-level privileges, based on the description.