Live › vulnerability › CVE-2026-98438
Go to dashboardWhen the kernel sends an MPTCP DATA_FIN with no payload, the DSS checksum field can be left uninitialised, so the outgoing packet may carry stale kernel memory. The sources describe this as an uninit-value fix in mptcp_write_data_fin, a regression from an earlier tcp memset change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with MPTCP enabled and a kernel built after commit cfcceb7a39fc are the ones the sources point to. Hosts that do not use MPTCP sockets, or run kernels without that commit, are unlikely to be affected. The sources do not give more detail.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel stable release in the NVD entrygrep -r mptcp /proc/sys/net/mptcp or check whether MPTCP is enabled with sysctl net.mptcp.enabled (unknown if the sources give a different check)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
mptcp: options: fix uninit-value in mptcp_write_data_fin
When sending a DATA_FIN without data, and because the DATA_FIN occupies 1 octet of the connection-level sequence space [1], it is then required to add a DSS mapping with specific values.
If the checksum has been negotiated, it also needs to be computed, and included in the outgoing packet, and thus the initial csum data needs to be reset to 0 as well. This is no longer the case since commit cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()"), because the whole ext_copy structure is no longer zeroed by default.
This seems to be the only case where use_map is changed and set afterwards, so initialising the csum field only in this case, along with other fields for this specific case.
This page as .md · .json · in your agent: get_signal("CVE-2026-98438")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.