{"id":"CVE-2026-98438","kind":"vulnerability","aliases":["CVE-2026-98438"],"related":[],"title":"Linux kernel: uninitialised MPTCP DATA_FIN checksum leaks kernel memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: options: fix uninit-value in mptcp_write_data_fin\n\nWhen sending a DATA_FIN without data, and because the DATA_FIN occupies\n1 octet of the connection-level sequence space [1], it is then required\nto add a DSS mapping with specific values.\n\nIf the checksum has been negotiated, it also needs to be computed, and\nincluded in the outgoing packet, and thus the initial csum data needs to\nbe reset to 0 as well. This is no longer the case since commit\ncfcceb7a39fc (\"tcp: shrink per-packet memset in __tcp_transmit_skb()\"),\nbecause the whole ext_copy structure is no longer zeroed by default.\n\nThis seems to be the only case where use_map is changed and set\nafterwards, so initialising the csum field only in this case, along with\nother fields for this specific case.","summary":"When the kernel sends an MPTCP DATA_FIN with no payload, the DSS checksum field can be left uninitialised, so the outgoing packet may carry stale kernel memory. The sources describe this as an uninit-value fix in mptcp_write_data_fin, a regression from an earlier tcp memset change.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","mptcp","runtime","self-hosted"],"not_affected_if":["mptcp-disabled"],"how_to_check":"- `uname -r` and compare against the fixed kernel stable release in the NVD entry\n- `grep -r mptcp /proc/sys/net/mptcp` or check whether MPTCP is enabled with `sysctl net.mptcp.enabled` (unknown if the sources give a different check)","fix":"- Update the Linux kernel to a stable release that includes the upstream commit for mptcp: options fix uninit-value in mptcp_write_data_fin (version unknown from sources)","status":"open","published_at":"2026-10-18T15:16:53+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:35+00:00","updated_at":"2026-10-25T05:27:35+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:27:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the upstream commit for mptcp: options fix uninit-value in mptcp_write_data_fin (version unknown from sources)","reach":"network","title":"Linux kernel: uninitialised MPTCP DATA_FIN checksum leaks kernel memory","impact":"low","summary":"When the kernel sends an MPTCP DATA_FIN with no payload, the DSS checksum field can be left uninitialised, so the outgoing packet may carry stale kernel memory. The sources describe this as an uninit-value fix in mptcp_write_data_fin, a regression from an earlier tcp memset change.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","mptcp","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel memory contents may leak onto the network in packets","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed kernel versions and whether exploitation is possible beyond information disclosure.","how_to_check":"- `uname -r` and compare against the fixed kernel stable release in the NVD entry\n- `grep -r mptcp /proc/sys/net/mptcp` or check whether MPTCP is enabled with `sysctl net.mptcp.enabled` (unknown if the sources give a different check)","needs_analyst":true,"not_affected_if":["mptcp-disabled"],"who_is_affected":"Systems running a Linux kernel with MPTCP enabled and a kernel built after commit cfcceb7a39fc are the ones the sources point to. Hosts that do not use MPTCP sockets, or run kernels without that commit, are unlikely to be affected. The sources do not give more detail.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":3504,"output_tokens":645,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98438':13A,16A '0':161C '1':110C,119C 'add':125C 'afterward':209C 'along':219C 'also':139C 'carri':49B 'case':169C,201C,218C,226C 'cfcceb7a39fc':172C 'chang':75B,206C 'checksum':7A,38B,134C 'commit':171C 'comput':143C 'connect':115C 'connection-level':114C 'copi':187C 'csum':154C,213C 'cve':11A,14A 'data':5A,31B,66B,95C,100C,103C,107C,155C 'default':194C 'describ':55B 'dss':37B,127C 'earlier':72B 'ext':186C 'field':39B,214C,222C 'fin':6A,32B,67B,96C,101C,108C 'fix':62B,88C 'follow':81C 'host':24B 'includ':145C 'initi':153C 'initialis':211C 'kernel':2A,9A,19B,27B,51B,79C 'leak':8A 'left':42B 'level':116C 'linux':1A,18B,78C 'linux-kernel':17B 'longer':167C,191C 'map':128C,204C 'may':48B 'memori':10A,52B 'memset':74B,178C 'mptcp':4A,20B,30B,64B,86C,93C 'need':140C,156C 'negoti':137C 'occupi':109C 'octet':111C 'option':87C 'outgo':46B,148C 'packet':47B,149C,177C 'payload':35B 'per':176C 'per-packet':175C 'regress':69B 'requir':123C 'reset':159C 'resolv':85C 'runtim':21B 'seem':196C 'self':23B 'self-host':22B 'send':28B,98C 'sequenc':117C 'set':208C 'shrink':174C 'sinc':170C 'skb':182C 'sourc':54B 'space':118C 'specif':130C,225C 'stale':50B 'structur':188C 'tcp':73B,173C,180C 'thus':151C 'transmit':181C 'uninit':60B,90C 'uninit-valu':59B,89C 'uninitialis':3A,43B 'use':203C 'valu':61B,91C,131C 'vulner':82C 'well':163C 'whole':185C 'without':102C 'write':65B,94C 'zero':192C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with MPTCP enabled and a kernel built after commit cfcceb7a39fc are the ones the sources point to. Hosts that do not use MPTCP sockets, or run kernels without that commit, are unlikely to be affected. The sources do not give more detail.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T15:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98438","severity":null,"published_at":"2026-10-18T15:16:53+00:00","modified_at":"2026-10-19T10:18:51+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}