Linux Kernel Vulnerability Affecting Multipath TCP Configuration

CVE-2026-98438

What is CVE-2026-98438?

A vulnerability in the Linux kernel related to the Multipath TCP (MPTCP) protocol has been identified. When sending a DATA_FIN packet without accompanying data, specific requirements for adding a Data Sequence Signal (DSS) mapping arise. The uninitialized checksum data leads to potential inconsistencies, as the necessary fields are not appropriately reset and initialized. This oversight in packet handling can expose vulnerabilities in data transmission for MPTCP configurations, necessitating immediate attention from system administrators to ensure security and integrity in network communications.

References