CVE-2026-98438: Linux Kernel MPTCP DATA_FIN Vulnerability

CVE-2026-98438 Overview

CVE-2026-98438 is an uninitialized memory use vulnerability in the Linux kernel's Multipath TCP (MPTCP) subsystem. The flaw resides in the mptcp_write_data_fin function within the MPTCP options handling code. When the kernel sends a DATA_FIN without accompanying data and checksum negotiation is active, the Data Sequence Signal (DSS) checksum field is no longer zero-initialized. This regression was introduced by commit cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()"), which removed the default zeroing of the ext_copy structure. The fix restores explicit initialization of the checksum and related fields for this specific code path.

Critical Impact

Uninitialized stack or structure memory can leak into outgoing MPTCP packets, potentially disclosing kernel data or causing protocol-level inconsistencies on affected hosts.

Affected Products

• Linux kernel versions containing commit cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()")
• Systems using Multipath TCP (MPTCP) with checksum negotiation enabled
• Linux distributions shipping affected mainline and stable kernel builds

Discovery Timeline

• 2026-10-18 - CVE-2026-98438 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98438

Vulnerability Analysis

The vulnerability affects the MPTCP options path responsible for emitting DATA_FIN segments. A DATA_FIN consumes one octet of the connection-level sequence space, which requires the sender to attach a DSS mapping with specific fields. When MPTCP checksum support has been negotiated between peers, the DSS checksum must also be computed and placed into the outgoing packet. The sender code relied on the surrounding ext_copy structure being zeroed by the TCP transmit path. After commit cfcceb7a39fc reduced the per-packet memset to improve performance, that assumption broke. The checksum field in the DSS mapping was then transmitted containing whatever residual bytes previously occupied that memory.

Root Cause

The root cause is an uninitialized memory use condition caused by an implicit dependency between two subsystems. The MPTCP code assumed the TCP layer would zero the ext_copy structure before use. When the TCP optimization removed that memset, the DSS checksum field in mptcp_write_data_fin was left uninitialized on the DATA_FIN-without-data path. According to the commit description, this is the only case where use_map is changed and set afterwards, so the fix initializes the csum field and other DSS fields only in this specific branch.

Attack Vector

The vulnerability triggers during normal MPTCP connection teardown when a peer sends a DATA_FIN without payload data and checksum negotiation is active. The resulting outgoing packet contains uninitialized bytes in the DSS checksum field. This can produce incorrect checksum values that cause receivers to drop segments, breaking connection termination semantics. In adversarial scenarios, an attacker who can observe MPTCP traffic may analyze leaked bytes for sensitive kernel memory content. No authentication or user interaction is required to reach the vulnerable code path on a system actively using MPTCP.

See the upstream fix in the Kernel Git Commit Details and the related Kernel Git Commit Review for exact source changes.

Detection Methods for CVE-2026-98438

Indicators of Compromise

• Unexpected MPTCP connection drops or resets during the FIN exchange on hosts running affected kernels.
• MPTCP checksum validation failures reported by peers when checksum negotiation is enabled.
• Kernel builds derived from mainline commit cfcceb7a39fc without the follow-up fix b110f1dd6cb6.

Detection Strategies

• Inventory running kernels and compare commit hashes against the upstream fix commit b110f1dd6cb6a9930503354a01a315e0a821eaa7.
• Enable KMSAN (Kernel Memory Sanitizer) in test builds to surface uninitialized value reads in mptcp_write_data_fin.
• Capture MPTCP flows with packet analyzers and inspect DSS option checksums for inconsistent values during connection teardown.

Monitoring Recommendations

• Monitor kernel logs for MPTCP subsystem warnings and anomalous checksum errors.
• Track network telemetry for elevated rates of MPTCP connection resets associated with DATA_FIN processing.
• Alert on deployment of kernel packages that predate the fix on production hosts that enable MPTCP.

How to Mitigate CVE-2026-98438

Immediate Actions Required

• Identify all Linux hosts with MPTCP enabled using sysctl net.mptcp.enabled and prioritize them for patching.
• Apply the vendor-supplied kernel update that includes commit b110f1dd6cb6a9930503354a01a315e0a821eaa7.
• Reboot patched systems to activate the updated kernel image.

Patch Information

The upstream Linux kernel fix initializes the DSS csum field and other required fields in mptcp_write_data_fin only on the DATA_FIN-without-data path. Apply the stable kernel update referenced in the Kernel Git Commit Details or install the equivalent patched package from your Linux distribution vendor.

Workarounds

• Disable MPTCP where it is not required by setting net.mptcp.enabled=0 via sysctl until the kernel is patched.
• Disable MPTCP checksum negotiation on affected endpoints if operationally acceptable, which avoids the vulnerable code branch.
• Restrict exposure of MPTCP-enabled services to trusted network segments during the remediation window.

# Configuration example
# Check whether MPTCP is enabled
sysctl net.mptcp.enabled

# Temporarily disable MPTCP until the kernel is patched
sudo sysctl -w net.mptcp.enabled=0

# Persist the change across reboots
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf