CVE-2026-97566

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0

The in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement

entry alive when removing the id 0 endpoint. This happens because the id 0

removal path does not tear down pending announcements, unlike the non-zero

id path.

When the PM later reselects id 0 after adding another signal endpoint, it

finds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel())

in mptcp_pm_announced_alloc().

Root cause: asymmetry between removal paths.

- Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls

mptcp_pm_remove_announced() to clean up.

- Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely.

Fix by making the id 0 path symmetric: call mptcp_pm_announced_remove()

and decrement add_addr_signaled before queuing the RM_ADDR.

Subtle detail: signal endpoints are stored in anno_list with port 0, but

msk_local carries the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References